- cleanupExpired() drops sessions expired by tokenTtl or sessionIdleTimeout and is
called opportunistically on issuing a token, bounding the session table; it is
protected and self-locking so subclasses can run it periodically
- issueToken() refuses a token already used by an active session instead of
silently merging two sessions (login replies 500 on a generator collision)
- document that the token generator must be collision-resistant
- tests: SessionCleanupOnLogin, ManualCleanup, TokenCollisionRejected
The idle timeout is opt-in: when set with setSessionIdleTimeout(), a session
expires after that period without a successful request and every successful
request extends it. When unset (the default), sessions are not touched and keep
the previous behavior: the absolute tokenTtl applied to created, or living until
logout. Both deadlines can be combined and the earlier one wins.
- SessionRec: add last_used, drop the unused refresh_token field
- checkToken(): update last_used only while the idle timeout is enabled
- tests: IdleTimeout, IdleActivityExtendsSession, IdleDisabledKeepsSession,
HasSessionIdleTimeout
The server no longer stores user accounts. PIHTTPServerMultiUser is renamed to
PIHTTPServerSessionAuth and keeps only the in-memory session table: credential
verification is delegated to the pure virtual checkCredentials(), implemented by
a client subclass that owns the user storage.
- remove UserRec, addUser/removeUser/userExists/userCount and the password
check callback; add protected revokeToken()/revokeUserTokens() helpers
- add configurable login/logout route paths (default /api/login, /api/logout)
- call checkCredentials() without holding the internal lock and report 500 when
the token generator yields no data
- rewrite tests around a client subclass with its own user table
andrey