feat: enforce configurable session expiration safely

2026-09-21 16:14:28 +08:00
parent 62872220f9
commit f252a7a195
2 changed files with 51 additions and 39 deletions
@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"

 	"chfs-ng/internal/api"
 	"chfs-ng/internal/auth"
@@ -68,7 +69,7 @@ func main() {
 	if len(cfg.Path) == 1 {
 		store = storage.Local{Root: root}
 	}
-	srv := &api.Server{Store: store, Auth: mgr, Sessions: map[string]*auth.Account{}, WebDAVRoot: root, Allow: cfg.Allow, MultiRoot: len(cfg.Path) > 1, RemoveMode: cfg.FileRemove, Log: opslog.New(cfg.Log)}
+	srv := &api.Server{Store: store, Auth: mgr, Sessions: map[string]*auth.Account{}, SessionExpiry: map[string]time.Time{}, SessionTimeout: cfg.SessionTimeout, WebDAVRoot: root, Allow: cfg.Allow, MultiRoot: len(cfg.Path) > 1, RemoveMode: cfg.FileRemove, Log: opslog.New(cfg.Log)}
 	addr := ":" + itoa(cfg.Port)
 	log.Printf("chfs-ng listening on %s root=%s removeMode=%d", addr, filepath.Clean(root), cfg.FileRemove)
 	if cfg.SSLCert != "" && cfg.SSLKey != "" {