Private
Public Access
ksmithandClaude Sonnet 5
b26643527d
Replaces the stateless signed-cookie session (bare user_id) with a real server-side sessions table -- the cookie now just carries an opaque session id, resolved against the DB on every request. Each session records IP address (respects X-Forwarded-For), a parsed device label, and last-seen time (throttled updates, not written on every request). New GET/DELETE /api/auth/sessions endpoints and an "Active sessions" section in Profile settings let a user see every device they're logged in from and revoke one they don't recognize -- including their own current session, which just signs them out. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
21 lines
671 B
Python
21 lines
671 B
Python
import uuid
|
|
from datetime import datetime
|
|
|
|
from pydantic import BaseModel
|
|
|
|
|
|
class SessionRead(BaseModel):
|
|
id: uuid.UUID
|
|
ip_address: str | None
|
|
# Parsed from the stored user_agent by the router (see
|
|
# user_agent_service.describe_user_agent) -- not a stored column, so a
|
|
# future improvement to the parser applies retroactively to old rows
|
|
# too.
|
|
device_label: str
|
|
created_at: datetime
|
|
last_seen_at: datetime
|
|
# Whether this is the session the request making this call is itself
|
|
# authenticated with -- lets the UI mark "this device" and treat
|
|
# revoking it as a self-logout rather than just another row.
|
|
is_current: bool
|