datatug / backend / 41882053246
100%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 419
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 99.995%. Remained the same
41882053246

push

github

web-flow 
feat(access): agent sessions and approval lifetimes (Perimeter D29) (#155)

Perimeter D29 agent sessions and approval lifetimes ([datatug/backstage#165](https://github.com/datatug/backstage/pull/165)), on datatug-core v0.141.0 ([datatug/datatug-core#451](https://github.com/datatug/datatug-core/pull/451)).

**Agent sessions** (REQ:agent-sessions):
- `POST /v0/datatug/access/agent/sessions` mints a session for a registered agent (product-delegation login plus `X-DataTug-Agent`) and one harness session ID, kept only as a per-project digest. The same agent and harness ID get the same live session (credential rotated; the previous stays valid until its own expiry). Another agent → `AGENT_SESSION_INVALID`. An ended session is never revived. Event `agent.session.started`.
- The credential `<sessionId>.<secret>` (256-bit secret, stored as a digest) travels in `X-DataTug-Agent-Session` on agent routes only. 15 min, extended by `POST …/{id}/refresh`.
- `POST …/{id}/end` by the agent (its credential) or its user (web sign-in) ends the session, withdraws its pending "This session" requests and cuts its approvals. Event `agent.session.ended`.
- 30 min idle (never early) and 12 h absolute expiry are applied at the session's next touch, with one `agent.session.expired` event; no scheduled job.
- At resolution the live session becomes `Resolution.AgentSession`, so Core counts "This session" approvals only there and never past its end. A bad credential → `AGENT_SESSION_INVALID`, an ended session → `AGENT_SESSION_ENDED`. Without a credential the agent keeps standing and deadline access.

**Lifetimes** (REQ:approval-lifetimes): an agent request defaults to "session" when a session credential is presented, otherwise "deadline". People have deadlines only. Once and Always are `LIFETIME_NOT_OFFERED` on the request flow. A "This session" request whose session ended is refused at decision with `APPROVAL_ENDED`. Events carry `lifetime` and `agentSessionId`.

Not in this PR (n... (continued)

56494 of 56497 relevant lines covered (99.99%)

1.0 hits per line

Jobs
ID Job ID Ran Files Coverage
1 41882053246.1 419
99.99
GitHub Action Run
Source Files on build 41882053246