Session Management

Free — GPL coresize Splanned, not built

Generated from docs/plan/core/session-management/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Session Management enforces session timeouts, allows merchants to view and revoke active sessions, and prevents concurrent login from multiple devices (optional).

The problem

Merchants’ devices get stolen and their store stays logged in; attackers access the admin forever.

What it does

• Session timeout (idle timeout: 30 min default, configurable)
• Activity extends timeout (any action resets timer)
• Force logout: one-click revoke all sessions
• List active sessions: device, IP, location, last activity, login time
• Revoke single session: end one device without affecting others
• Concurrent login limit (optional, e.g., max 3 sessions per user)
• Session data: ip_address, user_agent, device_name (parsed), location (GeoIP)
• Audit log: created, extended, revoked, timed out
• Secure cookie: httpOnly, Secure (HTTPS), SameSite=Strict

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• Device fingerprinting (block unknown devices) — security-hardening paid pack
• Geo-blocking (block unknown countries) — separate security feature
• Real-time suspicious activity alerts — analytics feature
• Session migration (session survives IP change) — assume same device = same IP
• Remember-me (extend session) — antipattern

Data model

Session: id, store_id, user_id, ip_address, user_agent, device_name (parsed), location (country/city), created_at, last_activity_at, expires_at, is_revoked. Migration: add sessions table with indexes on user_id and is_revoked.

API

• GET /admin/sessions
• DELETE /admin/sessions/{id}
• POST /admin/sessions/logout-all
• POST /auth/logout

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Sessions page: table of session, device, IP, location, login time, last activity; revoke/revoke-all buttons. Device: parsed from user_agent (Chrome on macOS, Safari on iPhone). Revoke flow: confirm to revoke all sessions.

The seam — why this is core

Core owns: Session table, timeout enforcement, cookie management (httpOnly/Secure/SameSite), activity extension. Paid module owns: GeoIP lookup (optional; fallback to IP-only).

Core owns the interface + honest session timeout; security is infrastructure, not a support commitment or credential.

Dependencies

• admin-user-management

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Login 10:00 AM; expires_at = 10:30 AM
• Inactive until 10:29, then click button; extends to 10:59 AM
• At 10:35 (idle since 10:29), session still valid if expires_at=10:59 is future; yes
• ‘Logout everywhere’ causes all sessions is_revoked=true; old cookie returns 401
• Revoking session A doesn’t affect session B
• Concurrent limit=2; 3rd login succeeds, oldest revoked
• Cookie httpOnly, Secure, SameSite=Strict
• Session from IP 192.168.1.1 to 192.168.1.2 keeps session valid (same device)

Risks

Timeout too short (5min) causes logged-out staff constantly. Timeout too long (8h) gives attacker large window. Activity extension never fires. Session ID collision. Concurrent limit enforced wrong. GeoIP lookup fails. Cookie not Secure flag.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.