fix(central-ui): resolve CentralUI-005 — sliding cookie session expiry (Security AddCookie + AuthEndpoints + SessionExpiry)

src/ScadaLink.CentralUI/Components/Shared/SessionExpiry.razor

@@ -3,37 +3,62 @@
 @inject NavigationManager Navigation
 
 @code {
+    // CentralUI-005: session expiry is a sliding window owned by the cookie
+    // authentication middleware (ScadaLink.Security AddCookie:
+    // ExpireTimeSpan = idle timeout, SlidingExpiration = true). An active user's
+    // cookie is continually renewed; an idle user's cookie lapses after the idle
+    // timeout. There is therefore no fixed login-time deadline to redirect at —
+    // the old code read an "expires_at" claim and scheduled a single hard
+    // redirect, which both contradicted the sliding policy and logged active
+    // users out mid-session.
+    //
+    // Instead this component polls the authentication state on a recurring
+    // interval. While the session is still valid it does nothing; once the
+    // sliding cookie has expired (the server-side idle cutoff has been reached)
+    // the next poll observes an unauthenticated principal and redirects to the
+    // login page. Re-checking the state is itself circuit activity, so this poll
+    // alone never keeps a truly idle session alive — only genuine user activity
+    // refreshes the cookie before it lapses.
+
+    /// <summary>How often the session validity is re-checked.</summary>
+    internal static readonly TimeSpan PollInterval = TimeSpan.FromMinutes(1);
+
     private CancellationTokenSource? _cts;
 
-    protected override async Task OnInitializedAsync()
+    protected override void OnInitialized()
     {
         // The login page uses the same layout, so this component renders there
-        // too. Redirecting /login → /login would loop ("too many redirects").
+        // too. Polling/redirecting on /login → /login would loop.
         var path = Navigation.ToBaseRelativePath(Navigation.Uri);
         if (path.StartsWith("login", StringComparison.OrdinalIgnoreCase)) return;
 
-        var auth = await AuthStateProvider.GetAuthenticationStateAsync();
-        if (auth.User.Identity?.IsAuthenticated != true) return;
-
-        var claim = auth.User.FindFirst("expires_at")?.Value;
-        if (!long.TryParse(claim, out var unix)) return;
-
-        var remaining = DateTimeOffset.FromUnixTimeSeconds(unix) - DateTimeOffset.UtcNow;
-        if (remaining <= TimeSpan.Zero)
-        {
-            Navigation.NavigateTo("/login", forceLoad: true);
-            return;
-        }
-
         _cts = new CancellationTokenSource();
-        _ = ScheduleRedirectAsync(remaining + TimeSpan.FromSeconds(2), _cts.Token);
+        _ = PollSessionAsync(_cts.Token);
     }
 
-    private async Task ScheduleRedirectAsync(TimeSpan delay, CancellationToken token)
+    private async Task PollSessionAsync(CancellationToken token)
     {
-        try { await Task.Delay(delay, token); }
-        catch (TaskCanceledException) { return; }
-        await InvokeAsync(() => Navigation.NavigateTo("/login", forceLoad: true));
+        while (!token.IsCancellationRequested)
+        {
+            try { await Task.Delay(PollInterval, token); }
+            catch (TaskCanceledException) { return; }
+
+            AuthenticationState auth;
+            try
+            {
+                auth = await AuthStateProvider.GetAuthenticationStateAsync();
+            }
+            catch (ObjectDisposedException)
+            {
+                return;
+            }
+
+            if (auth.User.Identity?.IsAuthenticated != true)
+            {
+                await InvokeAsync(() => Navigation.NavigateTo("/login", forceLoad: true));
+                return;
+            }
+        }
     }
 
     public void Dispose()