Give all sessions a uniform absolute lifetime of one week

Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.

1 files changed, 13 insertions, 0 deletions

diff --git a/test/controllers/admin_controller_test.rb b/test/controllers/admin_controller_test.rb
index a177851f..9747d8e9 100644
--- a/test/controllers/admin_controller_test.rb
+++ b/test/controllers/admin_controller_test.rb
@@ -45,4 +45,17 @@ class AdminControllerTest < ActionController::TestCase
     get :index
     assert_redirected_to edit_user_path(users(:quentin))
   end
+
+  test "a session older than the absolute limit is rejected" do
+    login_as :quentin
+    @request.session[:logged_in_at] = (AuthenticatedSystem::SESSION_MAX_AGE.ago - 1.day).to_i
+    get :index
+    assert_response :redirect
+  end
+
+  test "a fresh session carries the login stamp" do
+    login_as :quentin
+    get :index
+    assert_response :success
+  end
 end