feat(auth): org session policies — lifetime/idle limits, org-wide revocation by waleedlatif1 · Pull Request #5862 · simstudioai/sim

waleedlatif1 · 2026-07-22T22:00:06Z

Summary

New enterprise org setting: Session policies (org plane, security group) with maxSessionHours (absolute lifetime cap) and idleTimeoutHours (min 24h — session activity is only recorded once per cookie-cache window), plus a Sign out all members action
Enforcement is in the Better Auth database hooks: session.create.before clamps new sessions, and a new session.update.before hook re-clamps on every sliding refresh (Better Auth rewrites expiresAt to now+30d on refresh, which would silently stretch shortened sessions back out)
New organization.securityPolicyVersion counter wired into session.cookieCache.version (async fn): bumping it on policy save / revoke-all invalidates every cached session cookie in the org on its next request — revocation latency drops from the 24h cookie-cache lifetime to the ~60s policy-cache TTL. This machinery is shared groundwork for the upcoming IP-allowlisting and MFA-enforcement PRs
Policy saves also eagerly clamp existing member sessions in SQL (LEAST(expires_at, created_at + max, now() + idle)) so tightening applies without waiting for each session's next refresh
Impersonation sessions and org-less (personal) sessions are exempt; loosening a policy never extends an existing session
Migration 0265: two additive columns on organization (session_policy_settings json, security_policy_version int default 1)
EE-gated like data-retention: enterprise plan on hosted, NEXT_PUBLIC_SESSION_POLICIES_ENABLED override on self-host
New audit actions: organization.session_policy.updated, organization.sessions.revoked

Requires better-auth 1.6.23 (#5857, merged) for cookieCache.version and the update-hook context.

Known limitation (documented in code): live Socket.IO connections authenticate once at handshake, so revoke-all doesn't disconnect already-open sockets — they die on their next HTTP interaction.

Type of Change

New feature

Testing

15 new tests: clamp math (incl. the sliding-refresh re-clamp regression and idle floor) + route authz/validation/eager-clamp/version-bump
730 tests green across lib/auth, api/organizations, components/settings, ee
Typecheck, lint, check:api-validation, check:migrations all pass
Not yet live-tested — staging verification list: policy save → member session shortens; revoke-all → member signed out within ~60s; update.before hook context availability against a real refresh

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…ocation, cookie-cache versioning

vercel · 2026-07-22T22:00:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 22, 2026 11:38pm

cursor · 2026-07-22T22:00:17Z

PR Summary

High Risk
Changes authentication session lifetime, cookie-cache invalidation, and org-wide revocation—security-critical paths with broad member impact if mis-enforced.

Overview
Adds Enterprise session policies so org owners/admins can set optional max session lifetime and idle timeout (48h minimum), plus Sign out all members from a new Session policies settings screen (org security group, gated like other EE features).

Backend: GET/PUT /api/organizations/[id]/session-policy and POST /api/organizations/[id]/sessions/revoke persist settings on organization.session_policy_settings, bump security_policy_version, eagerly clamp existing member sessions in SQL on save, and revoke all member DB sessions (except caller/impersonation) atomically with a version bump. New security-policy and session-policy modules clamp expiresAt on session create/update, tie cookie-cache version to org membership + policy version, and apply policy when members join, transfer, or leave.

Auth integration: Better Auth hooks re-clamp sliding 30-day refreshes; migration 0265 adds the two org columns. Docs, audit actions, contracts, tests, and NEXT_PUBLIC_SESSION_POLICIES_ENABLED for self-host complete the surface.

^{Reviewed by Cursor Bugbot for commit ba7c70d. Configure here.}

greptile-apps · 2026-07-22T22:04:11Z

Greptile Summary

This PR adds organization-wide session policies and member session revocation. The main changes are:

Absolute and idle session lifetime limits.
Policy enforcement during session creation and refresh.
Atomic policy updates, eager session clamping, and cache-version bumps.
Organization-wide member sign-out with transactional revocation.
Enterprise settings UI, API contracts, migration, audit events, tests, and documentation.

Confidence Score: 5/5

The latest fixes look safe to merge.

Policy updates and eager session clamping now commit together.
Session deletion and the security-policy version bump now commit together.
Organization changes remount the policy form and reset its local state.

Important Files Changed

Filename	Overview
apps/sim/app/api/organizations/[id]/session-policy/route.ts	Stores the policy, increments its version, and clamps existing member sessions in one transaction.
apps/sim/app/api/organizations/[id]/sessions/revoke/route.ts	Deletes eligible member sessions and increments the organization security version in one transaction.
apps/sim/lib/auth/auth.ts	Adds cookie-cache versioning and clamps session expiry during creation and sliding refresh.
apps/sim/lib/auth/session-policy.ts	Implements policy lookup, expiry calculations, and transaction-compatible eager session clamping.
apps/sim/lib/auth/security-policy.ts	Resolves cached organization membership and security-policy versions for session cookie invalidation.
apps/sim/ee/session-policy/components/session-policy-settings.tsx	Adds the policy form and organization-wide member sign-out controls.

_{Reviews (12): Last reviewed commit: "fix(session-policy): unify join paths on..." | Re-trigger Greptile}

…curity-policy version module, canonical bounds, docs

waleedlatif1 · 2026-07-22T22:16:38Z

@greptile

waleedlatif1 · 2026-07-22T22:16:39Z

@cursor review

…set, state tracker, response-seeded baseline, comment trims

waleedlatif1 · 2026-07-22T22:21:37Z

@greptile

waleedlatif1 · 2026-07-22T22:21:38Z

@cursor review

…oke cookie-cache hole), normalize createdAt, remount on org switch, sync audit mock

waleedlatif1 · 2026-07-22T22:31:23Z

@greptile

waleedlatif1 · 2026-07-22T22:31:25Z

@cursor review

…rmalize expiresAt, sync unified nav test

waleedlatif1 · 2026-07-22T22:43:42Z

@greptile

waleedlatif1 · 2026-07-22T22:43:43Z

@cursor review

… spare impersonator sessions in revoke-all, raise idle floor to 2x cookie window

…bership TTL, admin-add cache invalidation

waleedlatif1 · 2026-07-22T23:09:47Z

@greptile

waleedlatif1 · 2026-07-22T23:09:48Z

@cursor review

…delete+bump

waleedlatif1 · 2026-07-22T23:15:40Z

@greptile

waleedlatif1 · 2026-07-22T23:15:41Z

@cursor review

…op enforcing automatically

waleedlatif1 · 2026-07-22T23:22:33Z

@greptile

waleedlatif1 · 2026-07-22T23:22:34Z

@cursor review

…all sites bump transactionally

waleedlatif1 · 2026-07-22T23:29:05Z

@greptile

waleedlatif1 · 2026-07-22T23:29:07Z

@cursor review

…r; final audit polish (dead exports, response bound, test name)

waleedlatif1 · 2026-07-22T23:38:01Z

@greptile

waleedlatif1 · 2026-07-22T23:38:02Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ba7c70d. Configure here.}

feat(auth): org session policies — lifetime/idle limits, org-wide rev…

15403c5

…ocation, cookie-cache versioning