Enforce session expiration on already-open event streams #66

New Issue

2026-11-05T12:09:30Z

spencerm commented

2026-11-05 12:09:30 +00:00

Priority: medium.

The event endpoint authenticates once when connecting. The loop in server/packetstation/events.py:254 stops on disconnect or explicit revoke, but does not enforce the session's expiry deadline or periodically validate its continued authorization.

Reproduce: open an authenticated event stream with a short remaining session lifetime, keep the connection open without further API requests, let the session expire, and publish another event. The loop has no expiry check before delivering it.

Impact: packet-update and presence metadata can continue reaching an expired session. Explicit revocation events are handled, but expiry alone is not sufficient.

Acceptance criteria:

Terminate streams at session expiry and periodically revalidate revocation/authorization as needed.
Avoid treating server pings or passive event delivery as user activity.
Remove expired subscriptions from presence and make the client handle expiry cleanly.
Test expiry without another HTTP request, explicit revoke, and missed revoke notifications.

Related: #34. Validation: static code-path review. Source: parent review.

Reviewed revision: 18333600b55b70971877c1a0c72d1d61b6ce9c69. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Priority: medium. The event endpoint authenticates once when connecting. The loop in [server/packetstation/events.py:254](https://gt.pescoinc.biz/spencerm/PacketStation/src/commit/18333600b55b70971877c1a0c72d1d61b6ce9c69/server/packetstation/events.py#L254) stops on disconnect or explicit revoke, but does not enforce the session's expiry deadline or periodically validate its continued authorization. Reproduce: open an authenticated event stream with a short remaining session lifetime, keep the connection open without further API requests, let the session expire, and publish another event. The loop has no expiry check before delivering it. Impact: packet-update and presence metadata can continue reaching an expired session. Explicit revocation events are handled, but expiry alone is not sufficient. Acceptance criteria: - Terminate streams at session expiry and periodically revalidate revocation/authorization as needed. - Avoid treating server pings or passive event delivery as user activity. - Remove expired subscriptions from presence and make the client handle expiry cleanly. - Test expiry without another HTTP request, explicit revoke, and missed revoke notifications. Related: #34. Validation: static code-path review. Source: parent review. Reviewed revision: `18333600b55b70971877c1a0c72d1d61b6ce9c69`. Raised from the November 2026 independent project reviews and parent verification. No production system was tested.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spencerm/PacketStation#66