Freegle / Iznik / 11652 / 11652

73%

master: 73%

push

circleci

fix(auth): refresh sessions.lastactive to give sliding session expiry

V1 PHP updates sessions.lastactive every 10+ minutes on any authenticated
request. The Go middleware only updated users.lastaccess, leaving
sessions.lastactive frozen at login time. The purge cron deletes sessions
where lastactive < 31 days ago, so active users were being logged out 31
days after login regardless of recent activity.

Uses a single conditional UPDATE (WHERE lastactive < NOW() - 10 MINUTE)
to avoid hammering the DB on every request, matching V1's throttle.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

4717 of 10292 branches covered (45.83%)

Branch coverage included in aggregate %.

2069 of 4241 relevant lines covered (48.79%)

41.29 hits per line