Harden authentication and put filter toggle and fields in one row

Security: per-username login throttling, constant-time unknown-user check,
Sec-Fetch-Site CSRF guard for writes, session rotation on login and
password change, absolute session lifetime, sessions ended on reset and
deactivation, last-admin protection, input length caps, ASCII usernames,
clickjacking headers. Covered by tests/authentication.test.ts.

Filter panel: toggle, fields and count share one row to save space.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/server/auth/sessions.ts

@@ -3,24 +3,50 @@ import { randomUUID } from "node:crypto";
 interface Session {
   id: string;
   userId: string;
+  createdAt: number;
   expiresAt: number;
 }
 
+const MAX_SESSIONS_PER_USER = 20;
+const SWEEP_INTERVAL_MS = 10 * 60 * 1000;
+
 /**
  * In-memory session store. The API runs as a single container/process, so a
  * restart clearing every session is an acceptable trade-off for the
  * simplicity of not needing a persisted session table.
+ *
+ * Sessions slide forward on activity (`idleTtlMs`) but never outlive
+ * `absoluteTtlMs` - otherwise a stolen cookie could be kept alive forever.
  */
 export class SessionStore {
   private readonly sessions = new Map<string, Session>();
 
-  constructor(private readonly ttlMs: number) {}
+  constructor(
+    private readonly idleTtlMs: number,
+    private readonly absoluteTtlMs: number,
+    private readonly now: () => number = Date.now
+  ) {}
+
+  /** Removes expired sessions; unreferenced ones would otherwise pile up. */
+  startSweeping(): void {
+    setInterval(() => this.sweep(), SWEEP_INTERVAL_MS).unref();
+  }
+
+  sweep(): void {
+    const now = this.now();
+    for (const [id, session] of this.sessions) {
+      if (this.isExpired(session, now)) this.sessions.delete(id);
+    }
+  }
 
   create(userId: string): Session {
+    this.enforcePerUserLimit(userId);
+    const now = this.now();
     const session: Session = {
       id: randomUUID(),
       userId,
-      expiresAt: Date.now() + this.ttlMs,
+      createdAt: now,
+      expiresAt: Math.min(now + this.idleTtlMs, now + this.absoluteTtlMs),
     };
     this.sessions.set(session.id, session);
     return session;
@@ -31,20 +57,28 @@ export class SessionStore {
     if (!sessionId) return undefined;
     const session = this.sessions.get(sessionId);
     if (!session) return undefined;
-    if (session.expiresAt < Date.now()) {
+    const now = this.now();
+    if (this.isExpired(session, now)) {
       this.sessions.delete(sessionId);
       return undefined;
     }
-    if (slideExpiry) session.expiresAt = Date.now() + this.ttlMs;
+    if (slideExpiry) {
+      session.expiresAt = Math.min(now + this.idleTtlMs, session.createdAt + this.absoluteTtlMs);
+    }
     return session;
   }
 
+  /** Remaining lifetime, used as cookie max-age so browser and server agree. */
+  remainingMs(session: Session): number {
+    return Math.max(0, session.expiresAt - this.now());
+  }
+
   destroy(sessionId: string | undefined): void {
     if (!sessionId) return;
     this.sessions.delete(sessionId);
   }
 
-  /** Ends every other session for a user, e.g. after a password change. */
+  /** Ends every session of a user, optionally except one (e.g. the caller's own). */
   destroyAllForUser(userId: string, exceptSessionId?: string): void {
     for (const [id, session] of this.sessions) {
       if (session.userId === userId && id !== exceptSessionId) {
@@ -52,4 +86,20 @@ export class SessionStore {
       }
     }
   }
+
+  private isExpired(session: Session, now: number): boolean {
+    return session.expiresAt <= now || session.createdAt + this.absoluteTtlMs <= now;
+  }
+
+  // Oldest sessions go first, so a legitimate user logging in on a new
+  // device is never refused - only memory growth is bounded.
+  private enforcePerUserLimit(userId: string): void {
+    const own = [...this.sessions.values()]
+      .filter((session) => session.userId === userId)
+      .sort((a, b) => a.createdAt - b.createdAt);
+    while (own.length >= MAX_SESSIONS_PER_USER) {
+      const oldest = own.shift();
+      if (oldest) this.sessions.delete(oldest.id);
+    }
+  }
 }