feat!: the idle timeout belongs to the canister - #181
Open
sea-snake wants to merge 4 commits into
Open
Conversation
`maxTimeToIdle` on `signIn()`, carried in the session request beside `maxTimeToLive` and clamped by the canister the same way. Sent only where the caller asked, so the provider's own default applies otherwise rather than a number this library invented.
… here BREAKING CHANGE: `IdleManager`, `IdleOptions` and `AuthClientCreateOptions.idleOptions` are removed. Pass `maxTimeToIdle` to `signIn()` instead, and subscribe for the sign-out a lapsed session produces. A timer in a page is skipped by clearing storage or by a tab that never runs it, and it saw one document, so a backgrounded tab could sign a user out of the tab beside it. The canister enforces the bound instead, across every tab of a browser at once, and activity minting is what keeps a present user from tripping it. The burst test now watches its own identity rather than a mint counter every live client increments.
There was a problem hiding this comment.
Pull request overview
This PR moves “idle timeout” enforcement out of the browser and into the identity provider canister by introducing maxTimeToIdle on AuthClient.signIn(), and removes the client-side IdleManager in favor of canister-side bounds. It also introduces activity-based foreground refresh triggers so sessions can be kept alive by user activity (including “reading” patterns like mouse movement), aligning safety with the new canister-enforced idle semantics.
Changes:
- Add
maxTimeToIdleplumbing throughAuthClient.signIn()→requestSessionDelegation()and ensure it’s omitted unless explicitly provided. - Remove the
IdleManagerAPI and associated tests; update AuthClient behavior and tests accordingly. - Add
watchActivity()and use it (alongsidewatchForeground()) to opportunistically refresh identities in the foreground while preventing overlapping refresh calls.
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/client/idle-manager.test.ts | Removes tests for the retired IdleManager. |
| tests/client/foreground-refresh.test.ts | Adds test coverage for new watchActivity() behavior. |
| tests/client/auth-client.test.ts | Updates AuthClient tests for removed idle options and adds coverage for maxTimeToIdle + activity-driven minting. |
| tests/client/auth-client-redirect.test.ts | Removes idle-manager-related setup/teardown in redirect-mode tests. |
| src/client/state-storage.ts | Changes StateStorage API around discard() and adds resumable metadata. |
| src/client/session-delegation.ts | Adds maxTimeToIdle to the session delegation JSON-RPC request when provided. |
| src/client/index.ts | Stops exporting the removed idle-manager module. |
| src/client/idle-manager.ts | Deletes the IdleManager implementation. |
| src/client/foreground-refresh.ts | Adds watchActivity() for activity-driven foreground refresh triggers. |
| src/client/auth-client.ts | Removes idle manager integration, adds maxTimeToIdle forwarding, and hooks activity/foreground refresh with concurrency guarding. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
maxTimeToIdleonsignIn(), carried in the session request besidemaxTimeToLiveand clamped by the canister the same way — 10 minutes to the session's own granted length, defaulting to seven days where a request names none.Sent only where the caller asked, so the provider's own default applies otherwise rather than a number this library invented.
IdleManagergoes with it. A timer in a page is skipped by clearing storage or by a tab that never runs it, and it saw one document, so a backgrounded tab could sign a user out of the tab beside it. The canister enforces the bound across every tab of a browser at once.The half that makes this safe is in the PR below: activity mints, so a user reading rather than clicking still keeps the session alive.
Breaking
IdleManager,IdleOptionsandAuthClientCreateOptions.idleOptionsare removed. Applications that setonIdlesubscribe for the sign-out instead; applications that setdisableIdledrop the option.