Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

2 files changed, 14 insertions, 0 deletions

diff --git a/test/controllers/admin_controller_test.rb b/test/controllers/admin_controller_test.rb
index a177851f..9747d8e9 100644
--- a/test/controllers/admin_controller_test.rb
+++ b/test/controllers/admin_controller_test.rb
@@ -45,4 +45,17 @@ class AdminControllerTest < ActionController::TestCase
     get :index
     assert_redirected_to edit_user_path(users(:quentin))
   end
+
+  test "a session older than the absolute limit is rejected" do
+    login_as :quentin
+    @request.session[:logged_in_at] = (AuthenticatedSystem::SESSION_MAX_AGE.ago - 1.day).to_i
+    get :index
+    assert_response :redirect
+  end
+
+  test "a fresh session carries the login stamp" do
+    login_as :quentin
+    get :index
+    assert_response :success
+  end
 end
diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index 62acd28a..86da0e61 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -9,6 +9,7 @@ class SessionsControllerTest < ActionController::TestCase
     post :create, params: { login: 'quentin', password: 'monkey' }
     assert session[:user_id]
     assert_response :redirect
+    assert session[:logged_in_at].present?
   end
 
   def test_should_fail_login_and_not_redirect