Clean up the device list: hide internal sessions, confirm destructive removal - #127
Merged
Conversation
Sessions the desktop process mints against its own backend (phone-link relay bridges and similar machine-to-machine logins) authenticate with the desktop bootstrap token over bearer auth and accumulated as meaningless desktop-bootstrap rows under Connected devices. Filter them out of the device list and the auth-access stream, keeping the caller's own session visible so every viewer can still see how it is connected.
Remove other devices now revokes exactly what the device list shows: internal desktop bearer sessions are skipped, so the action no longer severs a live phone-link connection. The bulk revoke-all-except chain through the control plane, credential service, and repository is now unused and removed. The web button opens a confirmation dialog stating how many devices will be signed out before anything is revoked.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
vouch:trusted
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Hide internal desktop sessions from the device list. Every phone-link bridge and desktop restart minted a bearer session under the internal
desktop-bootstrapsubject, so the Connected devices list filled up with identical "desktop-bootstrap · Owner · Desktop · 127.0.0.1" rows that mean nothing to the user. These machine-to-machine sessions are now filtered out ofServerAuth.listClientSessionsand thesubscribeAuthAccesslive stream. The requesting session is always kept visible, so a client whose own access rides on an internal session still sees itself as "This device". The CLI (threadlines auth sessions) still shows everything."Remove other devices" no longer severs phone-link bridges. The revoke-others action now targets only the sessions the list actually shows, using the same visibility predicate (
isInternalClientSessioninapps/server/src/auth/utils.ts), instead of a blanket revoke-all-except-current that silently killed active phone-link connections.Confirmation dialog for "Remove other devices". It signs out every other device, so it now asks first.
Tests
ServerAuth.test.ts: internal bearer sessions are hidden from the client list while cookie sessions stay visible; revoke-others spares internal sessions and still revokes visible devices.SettingsPanels.browser.tsx: confirmation dialog flow (confirm and cancel paths).vp fmt,vp lint,vp run typecheckgreen; server auth suites and settings browser suite pass.