Freegle / Iznik / 11652 / 11652

73%

master: 73%

push

circleci

fix(auth): refresh sessions.lastactive to give sliding session expiry

V1 PHP updates sessions.lastactive every 10+ minutes on any authenticated
request. The Go middleware only updated users.lastaccess, leaving
sessions.lastactive frozen at login time. The purge cron deletes sessions
where lastactive < 31 days ago, so active users were being logged out 31
days after login regardless of recent activity.

Uses a single conditional UPDATE (WHERE lastactive < NOW() - 10 MINUTE)
to avoid hammering the DB on every request, matching V1's throttle.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

9126 of 10553 branches covered (86.48%)

Branch coverage included in aggregate %.

62520 of 98745 relevant lines covered (63.31%)

10.88 hits per line