feat(auth): org session policies — lifetime/idle limits, org-wide revocation - #5862

Merged

waleedlatif1 merged 12 commits into

feat/org-session-policies

Jul 22, 2026

Commits on Jul 22, 2026

feat(auth): org session policies — lifetime/idle limits, org-wide revocation, cookie-cache versioning
waleedlatif1
committed
15403c5
refactor(auth): consolidate session-policy clamp semantics, shared security-policy version module, canonical bounds, docs
waleedlatif1
committed
8d27d15
polish(session-policy): cleanup pass — muted field labels, spinner reset, state tracker, response-seeded baseline, comment trims
waleedlatif1
committed
668aef4
fix(session-policy): govern member sessions by membership (closes revoke cookie-cache hole), normalize createdAt, remount on org switch, sync audit mock
waleedlatif1
committed
6817454
fix(session-policy): clamp pre-join sessions on invite acceptance, normalize expiresAt, sync unified nav test
waleedlatif1
committed
7902c2d
fix(session-policy): invalidate membership cache on removal/transfer, spare impersonator sessions in revoke-all, raise idle floor to 2x cookie window
waleedlatif1
committed
c17d5a1
fix(session-policy): resolve governing org by membership only — activeOrganizationId goes stale across transfer/leave
waleedlatif1
committed
458804e
fix(session-policy): atomic policy save + eager clamp, asymmetric membership TTL, admin-add cache invalidation
waleedlatif1
committed
c4b580d
fix(session-policy): org-scoped cookie version string, atomic revoke delete+bump
waleedlatif1
committed
9a67fc8
fix(session-policy): plan-gate effective policy so downgraded orgs stop enforcing automatically
waleedlatif1
committed
c0061f3
chore(session-policy): drop dead bumpSecurityPolicyVersion helper — call sites bump transactionally
waleedlatif1
committed
d1f43f0
fix(session-policy): unify join paths on applySessionPolicyToNewMember; final audit polish (dead exports, response bound, test name)
waleedlatif1
committed
ba7c70d