fix(auth): implement idle-session activity heartbeat (#583) - #748
Merged
MaryammAli merged 1 commit intoAug 29, 2026
Conversation
…os#583) - Add lastActivityAt to Session interface and populate it on creation - Implement validateSession() to check expiry/idle and advance lastActivityAt - Implement validateAndRefreshSession() as activity-aware guard helper - Add POST /auth/session/heartbeat endpoint for explicit client pings - Use per-session refresh lock to prevent concurrent heartbeat regressions - Fix corrupted auth-session.service.ts (duplicate methods, syntax errors) - Fix JwtLearnerGuard broken imports (SessionService, typos) - Fix JwtTutorGuard typos (jwtService, TUTOR) - Update JwtPayload to include sessionId/type for guard validation - Update auth-session spec and jwt-clock-skew spec for new signatures - Ensure refresh-token reuse revokes all user sessions
|
@azahjessica49-commits Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This PR implements an idle-session activity heartbeat mechanism so that authenticated activity updates a session's
lastActivityAttimestamp, making the configured idle timeout actually useful.Related Issue
Closes #583
Changes
[ADD] Session activity tracking
lastActivityAt: Dateadded toSessioninterface and populated on creationvalidateSession()— validates expiry/idle and atomically advanceslastActivityAtvalidateAndRefreshSession()— same, exposed for tutor-guard usageupdateLastActivity()— explicit heartbeat updater used by guards and new endpointwithRefreshLock— prevents concurrent heartbeat updates from regressing timestamps[ADD] Heartbeat API endpoint
POST /auth/session/heartbeat— allows clients to ping and keep an idle session alive[FIX] Corrupted auth-session.service.ts
absoluteExpiresAt,idleExpiresAt,deliveryGraceSeconds, andlastActivityAton session creation[FIX] JWT guards
JwtLearnerGuard— fixed completely broken imports (@nestj/common,JstService,SessionService)JwtTutorGuard— fixedthis&jwtServiceandUserRole.TUTIORtyposJwtPayload— addedsessionIdandtypeso guards can validate sessions from access tokensVerification Results
Acceptance Criteria
lastActivityAtvalidateSession()advanceslastActivityAtandidleExpiresAtatomicallyisSessionIdle()useslastActivityAt; idle sessions are revoked on validation/refreshwithRefreshLockserializes writes; monotonic checknewActivity > previousActivity