[omattsson]

Closes #706

Follow-ups to the logout session blocks of #699 (PR #704), plus two fixes the reviews found. Five commits, each builds and passes on its own.

Commits

1. fix(auth): logout-all blocks every recent session (#706 items 1–4, 6)

• Logout-all after a failed revoke (item 1). After RevokeAllForUser, logout-all lists the user's recent session families (ListRecentFamiliesForUser):

  • every family with a refresh-token row that expires after now minus (access-token lifetime + 1 minute + REFRESH_REUSE_GRACE), revoked or not, so a family revoked by idle timeout or the token cap is included;
  • newest first, at most 1000, with a warning at the limit.

  Each listed family and the bearer sid get a session block, the long block when the revoke failed, so no listed session can refresh.

• Failure cases. A failed listing is logged; the revoke and the user block still run. When the listing and the revoke both fail, only the presented session is blocked and the answer is 500.

• User block margin (item 2). No clock-skew margin on BlockUser: a margin would also reject a login right after logout-all, disable or password reset. Logout-all blocks each session instead, which does not compare issue times.

• Item 3: a docs note on failed revokes during a rolling update.

• Item 4: a test of the 499 branch of the refresh block check.

• Item 6: logout revokes with RevokeFamilyForUser (only the family of the user the credential names), and refreshConsumedToken's grace part moved to tryGraceRefresh, with identical behaviour.

2. test(sessionstore): benchmark the revocation lookups (item 5)

Measured, not implemented. One combined query for the jti, session and user checks would save about 0.8 ms per request on MySQL 8.4.4: 1.3–1.6 ms for three lookups against 0.5 ms for one query. At the API limit of 100 requests per minute per IP that is small, and a combined method would touch the store interface, both stores and every mock.

3. perf(sessionstore): batch the session blocks of logout-all

• What changed. BlockSessions writes one multi-row upsert per 500 sessions instead of one write per session. The handler makes at most two calls (normal and long blocks).
• Partial writes are intended. The batches are separate statements. A failed later batch leaves the earlier blocks written, and the error says how many. A block only ever blocks more, and a rollback would leave every session unblocked.

4. fix(auth): keep expired refresh-token rows while their session can hold a live token

• The gap. The cleanup deleted rows at expiry, so a session whose last row had just expired could drop out of the logout-all listing while its access token was still valid.
• The fix. It now keeps rows for the same window that the listing uses, through one shared helper (about 16 minutes with the defaults). Every "active" query already filters on expiry.

5. fix(database): set the MySQL session variables on every pooled connection

• The bug. Database.configure ran SET statements for sql_mode, time_zone and foreign_key_checks once after connecting, so they reached one pooled connection only.
• The fix. They are now DSN parameters (config.MySQLSessionParams), which the driver sets on every new connection.
• sql_mode is the MySQL 8 default, set explicitly. The old string was looser than what the pool and every integration test ran with.

Upgrade notes

For the release text:

• MySQL session settings: every database connection now uses sql_mode = the MySQL 8.0/8.4 default and time_zone = UTC, set by the backend instead of the server. In steady state this matches what most connections already ran with (the one connection with the old setting was recycled within DB_CONN_MAX_LIFETIME). The schema has no TIMESTAMP columns, so existing data is unaffected. A database whose server default sql_mode was looser now gets the strict mode.
• Refresh-token rows: expired rows are kept about 16 minutes longer than before (the access-token lifetime + 1 minute + REFRESH_REUSE_GRACE).
• Rolling update: until the leader runs this version, its cleanup still deletes at expiry.

No migration.

Tests

• Commit 1:
  • handler tests for the listing window (rows just inside and just outside it), revoked and legacy families, other users, the failure matrix, and a refresh after a failed logout-all on the normal and the grace path;
  • repository tests on SQLite and MySQL.
• Commit 3:
  • memory store;
  • MySQL with 1007 IDs across three batches, with a longer block pre-written in each batch;
  • a MySQL partial write;
  • the handler: one call for logout-all, two for a mix of lifetimes.
• Commit 4: the repository deletes only rows before the cutoff; the handler keeps rows inside the window.
• Commit 5:
  • DSN unit tests pin the encoded parameters;
  • a MySQL integration test opens the database through NewFromAppConfig, holds four pooled connections and checks the variables on each. It fails on the old code, because the server's time_zone is SYSTEM.
• Results:
  • go vet ./... and go vet -tags integration are clean.
  • go test ./... -short passes, as does go test -race for handlers, middleware, sessionstore, websocket, database, config and api.
  • The database and sessionstore MySQL integration suites pass on MySQL 8.4.4.
  • make gosec: 0 issues.

Review

• Commits 1 and 2: two review rounds.
• Commits 3–5: a comprehensive review and a re-review of the fixes.
• Outcome: no finding blocked the push, and all low and nit findings are fixed.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 02282e14-b937-4af6-a81b-f0854fec9e2b

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}