[FEATURE] Allow automatic session renewals

[mufeedali]

I want to put SilverBullet behind Tinyauth. But because TinyAuth doesn't automatically renew sessions with the Traefik forwardAuth. This sometimes results in SilverBullet's sync breaking mid-way through an initially valid session.

[steveiliop56]

Planned for v5 : )

[steveiliop56]

Initial implementation at #540.

[steveiliop56]

Implemented in #540. If the session is active (requests are being made) and it expires in less than an hour, we constantly "refresh" the expiry back to one hour until the user exits and the session finally expires.

[mufeedali]

Nice! Thanks!

[jo-chemla]

Nice to see the PR for this feature! How will the one hour session refresh be user controlled? Can it be edited via env? Thanks!

[steveiliop56]

The session is automatically renewed as long as requests are being made. This will work for something like web sockets which make constant requests but it won't work for something that makes very occasional requests because there isn't any way to know if the user is active (although doubt that there is any app that won't make any request in a span of a few minutes). There is no option to control for how long the session will be renewed for because I don't think there is a reason for the user to need to modify that. Keep in mind that once the session starts the refresh process (so it gets refreshed right before it expires) it's practically semi-expired and it will end once the active session refreshing it expires and thus the one hour runs out.

[jo-chemla]

Thanks for getting back so fast.
This great article mentions idle, renewal and absolute timeouts. My question was whether it was possible with tinyauth to set this renewal timeout to either 10min for sensitive apps, or 1 week or 1 months for less sensitive ones.

[steveiliop56]

Right now it's not possible but could be added in the future although I do believe it's a bit of niche use case.