* Add active web-UI session management
Allow users to view and revoke active login sessions. This enhances security and control by providing insights into authenticated access and the ability to sign out remote devices.
* Review comments
* Refine web-UI session management and persistence
Optimize how session activity (last seen, IP, user agent) is persisted by
decoupling frequent in-memory updates from throttled disk writes.
Ensure the session list and revoke button accurately reflect valid sessions
and current login credentials.
Add explicit session flushing at shutdown and refactor login configuration
checks into a dedicated helper function.
* Ensure SessionStore thread-safety and enhance pruning
The `SessionStore` is accessed concurrently by the web server's event loop and the PostProcessor thread. This concurrent access previously lacked synchronization, which could lead to race conditions and data integrity issues.
This change implements `threading.RLock()` and the `@synchronized()` decorator to ensure all `SessionStore` operations are thread-safe.
The session pruning logic is also enhanced to actively remove sessions associated with outdated credentials from memory and disk, improving security and data hygiene. New tests validate concurrent access and the enhanced pruning.
* Review comments
* Add a session store that keeps web-UI logins in the admin folder
* Authenticate the web interface with session cookies and CSRF tokens
* Stop embedding the apikey in the web interface
* Cover the session, CSRF and apikey changes
Safihre