Add inactivity-based session timeout (closes #66)

Sessions had only a 7-day absolute lifetime, and that cap was enforced
only by the cookie's MaxAge -- i.e. only by the browser. An abandoned
session stayed usable for the full week.

Sessions are now bounded by two independent, server-enforced clocks,
and end at whichever expires first:

- absolute: created_at + 7 days, stamped once by SetUser and never
  rewritten, so no amount of activity can extend it
- idle: last_seen + SESSION_IDLE_TIMEOUT (default 24h), pushed forward
  by the new Session.Touch

Both deadlines are checked in Session.expired, which IsAuthenticated
now consults, so every existing authentication decision honours them
without each call site having to remember.

Activity means a request that passes RequireAuth, which is the only
place Touch is called; an unauthenticated request carrying the cookie
cannot keep a session alive. Touch re-checks authentication itself so
that guarantee does not depend on the call site.

To avoid re-issuing the session cookie on every authenticated request,
Touch rewrites last_seen only once it is older than a tenth of the idle
window. The session therefore expires up to 10% early relative to the
user's true last request, never late.

An authenticated session carrying no timestamps (a cookie minted before
this change) is treated as expired, so the failure mode of the upgrade
is one forced re-login rather than an unbounded session.

Tests use an injected clock rather than sleeps and cover idle expiry,
refresh on activity, an actively used session still dying at the
absolute cap, refusal to refresh unauthenticated or expired sessions,
disabled idle expiry, and startup aborting on an unparseable
SESSION_IDLE_TIMEOUT.

README.md

@@ -89,26 +89,30 @@ TTY detection, and security headers are always applied.
 | `PORT`                  | HTTP listen port                    | `8080`   |
 | `DATA_DIR`              | Directory for all SQLite databases  | `/var/lib/webhooker` |
 | `DEBUG`                 | Enable debug logging                | `false`  |
-| `MAINTENANCE_MODE`      | Serve the maintenance page          | `false`  |
 | `METRICS_USERNAME`      | Basic auth username for `/metrics`  | `""`     |
 | `METRICS_PASSWORD`      | Basic auth password for `/metrics`  | `""`     |
 | `SENTRY_DSN`            | Sentry error reporting DSN          | `""`     |
+| `SESSION_IDLE_TIMEOUT`  | Idle session timeout (Go duration)  | `24h`    |
 
-#### Invalid values abort startup
+Sessions are bounded by two independent clocks, and end at whichever
+one runs out first:
 
-The defaults above apply **only** to variables that are unset (or set
-to an empty string). A variable that is set but cannot be parsed is a
-fatal configuration error: webhooker logs the offending variable and
-its value and refuses to start, rather than silently running with a
-substituted default. `PORT=eighty`, `DEBUG=ture`, and
-`RETENTION_SWEEP_INTERVAL=1 hour` all abort startup. `PORT` must
-additionally be a number in the range 1–65535.
+- **Idle expiry** (`SESSION_IDLE_TIMEOUT`, default `24h`) is a sliding
+  window. Every authenticated request pushes it forward, so a session
+  in continuous use never hits it, while an abandoned one expires a day
+  after its last use. Set it to `0` to disable idle expiry entirely;
+  the absolute cap below still applies. A set-but-unparseable value
+  aborts startup rather than silently falling back to the default.
+- **Absolute expiry** is a fixed 7 days from login. Activity does
+  **not** extend it: after a week, every session ends and the user
+  authenticates again.
 
-Boolean variables (`DEBUG`, `MAINTENANCE_MODE`) accept exactly the
-spellings Go's `strconv.ParseBool` accepts — `1`, `t`, `T`, `TRUE`,
-`true`, `True`, `0`, `f`, `F`, `FALSE`, `false`, `False` — and nothing
-else. `yes`, `on`, and `off` are rejected rather than quietly treated
-as false.
+Only requests that authenticate with the session count as activity, so
+an unauthenticated request carrying the cookie cannot keep a session
+alive. The idle timestamp is rewritten at most once per tenth of the
+idle window rather than on every request, which means a session may
+expire up to 10% early relative to the user's true last request, but
+never late.
 
 On first startup, webhooker automatically generates a cryptographically
 secure session encryption key and stores it in the database. This key

TODO.md

@@ -10,28 +10,28 @@
 
 # Status
 
-pre-1.0. No git tags exist. main (4f5ecb1) is a working webhook proxy
+pre-1.0. No git tags exist. main (afe88c6) is a working webhook proxy
 with auth, CSRF/SSRF protections, login rate limiting, Slack target,
-policy compliance (#6), pinned lint tooling (#55), a per-webhook event
-retention reaper (#63), and fail-loud configuration parsing (#80). Note:
-TODO.md was deliberately deleted from this repo in f9a9569 (2026-03-01,
-#6); its content was folded into the README TODO section, which this
-draft reconstructs as of 2026-07-06.
+policy compliance (#6), and pinned lint tooling (#55). Note: TODO.md was
+deliberately deleted from this repo in f9a9569 (2026-03-01, #6); its
+content was folded into the README TODO section, which this draft
+reconstructs as of 2026-07-06.
 
 # Next Step
 
-Manual event redelivery from the web UI (replay is a core promised
-capability in the README rationale).
+Implement automatic event retention cleanup based on retention_days: a
+periodic maintenance job that deletes Events, Deliveries, and
+DeliveryResults older than the parent webhook's retention_days from each
+per-webhook event database. The field exists on the Webhook model and
+the README promises the behavior, but nothing enforces it, so event
+databases currently grow without bound.
 
 # Completed Steps
 
-- 2026-08-09 Configuration parsing fails loudly on set-but-unparseable
-  environment values: `envInt` removed in favour of `envPositiveInt`
-  plus a `PORT` range check, `envBool` now parses with
-  `strconv.ParseBool`, and defaults apply only to unset variables (#80)
-- 2026-08-07 Automatic event retention cleanup based on
-  `retention_days`, deleting expired events, deliveries, and delivery
-  results from each per-webhook event database (#63)
+- 2026-08-09 Inactivity-based session timeout: sliding idle expiry
+  (`SESSION_IDLE_TIMEOUT`, default `24h`) refreshed on authenticated
+  requests, with the 7-day absolute cap kept as an independent
+  backstop that activity never extends (#66)
 - 2026-08-07 Update golangci-lint to v2.12.2 (Docker image digest in
   `Dockerfile`, release-archive sha256 pins in `script/bootstrap`),
   adopt the canonical `.golangci.yml` (v2 `linters.settings` layout so
@@ -60,6 +60,8 @@ capability in the README rationale).
 
 # Future Steps
 
+- Manual event redelivery from the web UI (replay is a core promised
+  capability in the README rationale)
 - Delivery status and retry management UI
 - Per-webhook rate limiting in the receiver handler (per-webhook config
   plus handler enforcement; global limits must not apply to receiver
@@ -73,7 +75,7 @@ capability in the README rationale).
     - event redelivery endpoint
     - OpenAPI specification
 - Analytics dashboard: success rates, response times, volume
-- Session expiration tuning and a remember-me option
+- A remember-me option at login
 - Password change and reset flow
 - Later, nice to have
     - email delivery target type

internal/config/config.go

@@ -7,6 +7,7 @@ import (
 	"log/slog"
 	"os"
 	"strconv"
+	"strings"
 	"time"
 
 	"go.uber.org/fx"
@@ -31,23 +32,15 @@ const (
 	// reaper deletes events older than each webhook's RetentionDays.
 	defaultRetentionSweepInterval = time.Hour
 
-	// maxPort is the highest valid TCP port number. The lower
-	// bound (at least 1) is enforced by envPositiveInt.
-	maxPort = 65535
+	// defaultSessionIdleTimeout is how long a session may go without
+	// authenticated activity before it expires.
+	defaultSessionIdleTimeout = 24 * time.Hour
 )
 
 // ErrInvalidEnvironment is returned when WEBHOOKER_ENVIRONMENT
 // contains an unrecognised value.
 var ErrInvalidEnvironment = errors.New("invalid environment")
 
-// ErrNonPositiveValue is returned when an environment variable that
-// requires a positive integer is set to zero or a negative number.
-var ErrNonPositiveValue = errors.New("value must be positive")
-
-// ErrInvalidPort is returned when an environment variable holding a
-// TCP port number is set above the valid port range.
-var ErrInvalidPort = errors.New("invalid port")
-
 //nolint:revive // ConfigParams is a standard fx naming convention.
 type ConfigParams struct {
 	fx.In
@@ -71,6 +64,10 @@ type Config struct {
 	// RetentionSweepInterval is how often the retention reaper runs.
 	RetentionSweepInterval time.Duration
 
+	// SessionIdleTimeout is the sliding inactivity window after
+	// which a session expires. Non-positive disables idle expiry.
+	SessionIdleTimeout time.Duration
+
 	params *ConfigParams
 	log    *slog.Logger
 }
@@ -92,81 +89,27 @@ func envString(key string) string {
 }
 
 // envBool returns the value of the named environment variable
-// parsed as a boolean. Returns defaultValue if not set. If the
-// variable is set but cannot be parsed, it returns a wrapped error
-// naming the key and the bad value, so startup fails loudly rather
-// than silently falling back to the default.
-//
-// Parsing is strconv.ParseBool, which accepts 1, t, T, TRUE, true,
-// True, 0, f, F, FALSE, false and False. Anything else — "yes",
-// "on", or a typo like "ture" — is an error rather than a silent
-// false.
-func envBool(key string, defaultValue bool) (bool, error) {
-	v := os.Getenv(key)
-	if v == "" {
-		return defaultValue, nil
+// parsed as a boolean. Returns defaultValue if not set.
+func envBool(key string, defaultValue bool) bool {
+	if v := os.Getenv(key); v != "" {
+		return strings.EqualFold(v, "true") || v == "1"
 	}
 
-	b, err := strconv.ParseBool(v)
-	if err != nil {
-		return false, fmt.Errorf(
-			"invalid boolean for %s: %q: %w", key, v, err,
-		)
-	}
-
-	return b, nil
+	return defaultValue
 }
 
-// envPositiveInt returns the value of the named environment variable
-// parsed as a positive integer. Returns defaultValue if not set. If
-// the variable is set but cannot be parsed, or parses to less than
-// one, it returns a wrapped error naming the key and the bad value,
-// so startup fails loudly rather than silently falling back to the
-// default.
-func envPositiveInt(
-	key string,
-	defaultValue int,
-) (int, error) {
-	v := os.Getenv(key)
-	if v == "" {
-		return defaultValue, nil
-	}
-
+// envInt returns the value of the named environment variable
+// parsed as an integer. Returns defaultValue if not set or
+// unparseable.
+func envInt(key string, defaultValue int) int {
+	if v := os.Getenv(key); v != "" {
 		i, err := strconv.Atoi(v)
-	if err != nil {
-		return 0, fmt.Errorf(
-			"invalid integer for %s: %q: %w", key, v, err,
-		)
+		if err == nil {
+			return i
+		}
 	}
 
-	if i < 1 {
-		return 0, fmt.Errorf(
-			"%w: %s must be at least 1, got %q",
-			ErrNonPositiveValue, key, v,
-		)
-	}
-
-	return i, nil
-}
-
-// envPort returns the value of the named environment variable parsed
-// as a TCP port number. Returns defaultValue if not set. A set value
-// that is unparseable, below 1, or above maxPort is a hard error
-// naming the key and the bad value.
-func envPort(key string, defaultValue int) (int, error) {
-	port, err := envPositiveInt(key, defaultValue)
-	if err != nil {
-		return 0, err
-	}
-
-	if port > maxPort {
-		return 0, fmt.Errorf(
-			"%w: %s must be at most %d, got %d",
-			ErrInvalidPort, key, maxPort, port,
-		)
-	}
-
-	return port, nil
+	return defaultValue
 }
 
 // envDuration returns the value of the named environment variable
@@ -193,52 +136,32 @@ func envDuration(
 	return d, nil
 }
 
-// resolveEnvironment reads WEBHOOKER_ENVIRONMENT, defaulting to
-// dev, and rejects unrecognised values.
-func resolveEnvironment() (string, error) {
+// New creates a Config by reading environment variables.
+//
+//nolint:revive // lc parameter is required by fx even if unused.
+func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
+	log := params.Logger.Get()
+
+	// Determine environment from WEBHOOKER_ENVIRONMENT env var,
+	// default to dev
 	environment := os.Getenv("WEBHOOKER_ENVIRONMENT")
 	if environment == "" {
 		environment = EnvironmentDev
 	}
 
+	// Validate environment
 	if environment != EnvironmentDev &&
 		environment != EnvironmentProd {
-		return "", fmt.Errorf(
+		return nil, fmt.Errorf(
 			"%w: WEBHOOKER_ENVIRONMENT must be '%s' or '%s', got '%s'",
 			ErrInvalidEnvironment,
 			EnvironmentDev, EnvironmentProd, environment,
 		)
 	}
 
-	return environment, nil
-}
-
-// loadFromEnv builds a Config from the environment. Every value that
-// needs parsing fails loudly when it is set but unparseable: the
-// documented defaults apply only to variables that are unset (or
-// empty), never as a substitute for a value the operator actually
-// provided.
-func loadFromEnv() (*Config, error) {
-	environment, err := resolveEnvironment()
-	if err != nil {
-		return nil, err
-	}
-
-	port, err := envPort("PORT", defaultPort)
-	if err != nil {
-		return nil, err
-	}
-
-	debug, err := envBool("DEBUG", false)
-	if err != nil {
-		return nil, err
-	}
-
-	maintenanceMode, err := envBool("MAINTENANCE_MODE", false)
-	if err != nil {
-		return nil, err
-	}
-
+	// Parse the retention sweep interval; a set-but-unparseable value
+	// is a hard error so fx aborts startup rather than silently using
+	// the default.
 	retentionSweepInterval, err := envDuration(
 		"RETENTION_SWEEP_INTERVAL",
 		defaultRetentionSweepInterval,
@@ -247,35 +170,30 @@ func loadFromEnv() (*Config, error) {
 		return nil, err
 	}
 
-	return &Config{
-		DataDir:                envString("DATA_DIR"),
-		Debug:                  debug,
-		MaintenanceMode:        maintenanceMode,
-		Environment:            environment,
-		MetricsUsername:        envString("METRICS_USERNAME"),
-		MetricsPassword:        envString("METRICS_PASSWORD"),
-		Port:                   port,
-		SentryDSN:              envString("SENTRY_DSN"),
-		RetentionSweepInterval: retentionSweepInterval,
-	}, nil
-}
-
-// New creates a Config by reading environment variables.
-//
-//nolint:revive // lc parameter is required by fx even if unused.
-func New(lc fx.Lifecycle, params ConfigParams) (*Config, error) {
-	log := params.Logger.Get()
-
-	// A set-but-unparseable value anywhere in the environment is a
-	// hard error, so fx aborts startup rather than running with a
-	// silently substituted default.
-	s, err := loadFromEnv()
+	// Same fail-loud treatment for the session idle timeout.
+	sessionIdleTimeout, err := envDuration(
+		"SESSION_IDLE_TIMEOUT",
+		defaultSessionIdleTimeout,
+	)
 	if err != nil {
 		return nil, err
 	}
 
-	s.log = log
-	s.params = &params
+	// Load configuration values from environment variables
+	s := &Config{
+		DataDir:                envString("DATA_DIR"),
+		Debug:                  envBool("DEBUG", false),
+		MaintenanceMode:        envBool("MAINTENANCE_MODE", false),
+		Environment:            environment,
+		MetricsUsername:        envString("METRICS_USERNAME"),
+		MetricsPassword:        envString("METRICS_PASSWORD"),
+		Port:                   envInt("PORT", defaultPort),
+		SentryDSN:              envString("SENTRY_DSN"),
+		RetentionSweepInterval: retentionSweepInterval,
+		SessionIdleTimeout:     sessionIdleTimeout,
+		log:                    log,
+		params:                 &params,
+	}
 
 	// Set default DataDir. All SQLite databases (main application
 	// DB and per-webhook event DBs) live here. The same default is

internal/config/config_test.go

@@ -163,7 +163,7 @@ func TestRetentionSweepInterval(t *testing.T) {
 			}
 
 			if tt.expectError {
-				testRetentionSweepIntervalError(t)
+				expectStartupError(t)
 			} else {
 				testRetentionSweepIntervalSuccess(t, tt.expected)
 			}
@@ -171,7 +171,9 @@ func TestRetentionSweepInterval(t *testing.T) {
 	}
 }
 
-func testRetentionSweepIntervalError(t *testing.T) {
+// expectStartupError asserts that fx refuses to build the app,
+// which is what a set-but-unparseable duration must cause.
+func expectStartupError(t *testing.T) {
 	t.Helper()
 
 	var cfg *config.Config
@@ -215,6 +217,82 @@ func testRetentionSweepIntervalSuccess(
 	assert.Equal(t, expected, cfg.RetentionSweepInterval)
 }
 
+func TestSessionIdleTimeout(t *testing.T) {
+	tests := []struct {
+		name        string
+		set         bool
+		value       string
+		expectError bool
+		expected    time.Duration
+	}{
+		{
+			name:     "unset uses default",
+			set:      false,
+			expected: 24 * time.Hour,
+		},
+		{
+			name:     "valid value is parsed",
+			set:      true,
+			value:    "30m",
+			expected: 30 * time.Minute,
+		},
+		{
+			name:        "unparseable value fails startup",
+			set:         true,
+			value:       "not-a-duration",
+			expectError: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Cannot use t.Parallel() here because t.Setenv
+			// is incompatible with parallel subtests.
+			t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
+
+			if tt.set {
+				t.Setenv("SESSION_IDLE_TIMEOUT", tt.value)
+			} else {
+				require.NoError(t, os.Unsetenv(
+					"SESSION_IDLE_TIMEOUT",
+				))
+			}
+
+			if tt.expectError {
+				expectStartupError(t)
+			} else {
+				testSessionIdleTimeoutSuccess(t, tt.expected)
+			}
+		})
+	}
+}
+
+func testSessionIdleTimeoutSuccess(
+	t *testing.T,
+	expected time.Duration,
+) {
+	t.Helper()
+
+	var cfg *config.Config
+
+	app := fxtest.New(
+		t,
+		fx.Provide(
+			globals.New,
+			logger.New,
+			config.New,
+		),
+		fx.Populate(&cfg),
+	)
+	require.NoError(t, app.Err())
+
+	app.RequireStart()
+
+	defer app.RequireStop()
+
+	assert.Equal(t, expected, cfg.SessionIdleTimeout)
+}
+
 func TestDefaultDataDir(t *testing.T) {
 	for _, env := range []string{"", "dev", "prod"} {
 		name := env

internal/config/env_test.go

@@ -1,409 +0,0 @@
-package config_test
-
-import (
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"go.uber.org/fx"
-	"sneak.berlin/go/webhooker/internal/config"
-	"sneak.berlin/go/webhooker/internal/globals"
-	"sneak.berlin/go/webhooker/internal/logger"
-)
-
-// testEnvKey is a throwaway variable name used only by the helper
-// tables below, so they cannot disturb real configuration.
-const testEnvKey = "WEBHOOKER_TEST_VALUE"
-
-// Real configuration variables exercised by the config.New tests.
-const (
-	envKeyPort            = "PORT"
-	envKeyDebug           = "DEBUG"
-	envKeyMaintenanceMode = "MAINTENANCE_MODE"
-)
-
-// envBoolCase is one row of the envBool table.
-type envBoolCase struct {
-	name         string
-	set          bool
-	value        string
-	defaultValue bool
-	expectError  bool
-	expected     bool
-}
-
-// envBoolCases is the envBool table, kept out of the test body so
-// the test itself stays readable.
-func envBoolCases() []envBoolCase {
-	return []envBoolCase{
-		{
-			name:         "unset uses default false",
-			defaultValue: false,
-			expected:     false,
-		},
-		{
-			name:         "unset uses default true",
-			defaultValue: true,
-			expected:     true,
-		},
-		{
-			name:         "empty uses default true",
-			set:          true,
-			value:        "",
-			defaultValue: true,
-			expected:     true,
-		},
-		{
-			name:     "true is parsed",
-			set:      true,
-			value:    "true",
-			expected: true,
-		},
-		{
-			name:     "one is parsed",
-			set:      true,
-			value:    "1",
-			expected: true,
-		},
-		{
-			name:         "False is parsed",
-			set:          true,
-			value:        "False",
-			defaultValue: true,
-			expected:     false,
-		},
-		{
-			name:         "zero is parsed",
-			set:          true,
-			value:        "0",
-			defaultValue: true,
-			expected:     false,
-		},
-		{
-			name:        "yes is rejected",
-			set:         true,
-			value:       "yes",
-			expectError: true,
-		},
-		{
-			name:        "on is rejected",
-			set:         true,
-			value:       "on",
-			expectError: true,
-		},
-		{
-			name:        "typo is rejected",
-			set:         true,
-			value:       "ture",
-			expectError: true,
-		},
-	}
-}
-
-func TestEnvBool(t *testing.T) {
-	for _, tt := range envBoolCases() {
-		t.Run(tt.name, func(t *testing.T) {
-			// Cannot use t.Parallel() here because t.Setenv
-			// is incompatible with parallel subtests.
-			if tt.set {
-				t.Setenv(testEnvKey, tt.value)
-			} else {
-				require.NoError(t, os.Unsetenv(testEnvKey))
-			}
-
-			got, err := config.EnvBoolForTest(
-				testEnvKey, tt.defaultValue,
-			)
-
-			if tt.expectError {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), testEnvKey)
-				assert.Contains(t, err.Error(), tt.value)
-
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}
-
-func TestEnvPositiveInt(t *testing.T) {
-	const defaultValue = 7
-
-	tests := []struct {
-		name        string
-		set         bool
-		value       string
-		expectError bool
-		errIs       error
-		expected    int
-	}{
-		{
-			name:     "unset returns the default integer",
-			expected: defaultValue,
-		},
-		{
-			name:     "empty returns the default integer",
-			set:      true,
-			value:    "",
-			expected: defaultValue,
-		},
-		{
-			name:     "positive value is parsed",
-			set:      true,
-			value:    "42",
-			expected: 42,
-		},
-		{
-			name:        "unparseable value is rejected",
-			set:         true,
-			value:       "not-a-number",
-			expectError: true,
-		},
-		{
-			name:        "zero is rejected",
-			set:         true,
-			value:       "0",
-			expectError: true,
-			errIs:       config.ErrNonPositiveValue,
-		},
-		{
-			name:        "negative is rejected",
-			set:         true,
-			value:       "-5",
-			expectError: true,
-			errIs:       config.ErrNonPositiveValue,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Cannot use t.Parallel() here because t.Setenv
-			// is incompatible with parallel subtests.
-			if tt.set {
-				t.Setenv(testEnvKey, tt.value)
-			} else {
-				require.NoError(t, os.Unsetenv(testEnvKey))
-			}
-
-			got, err := config.EnvPositiveIntForTest(
-				testEnvKey, defaultValue,
-			)
-
-			if tt.expectError {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), testEnvKey)
-				assert.Contains(t, err.Error(), tt.value)
-
-				if tt.errIs != nil {
-					require.ErrorIs(t, err, tt.errIs)
-				}
-
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}
-
-func TestEnvPort(t *testing.T) {
-	const defaultValue = 8080
-
-	tests := []struct {
-		name        string
-		set         bool
-		value       string
-		expectError bool
-		errIs       error
-		expected    int
-	}{
-		{
-			name:     "unset returns the default port",
-			expected: defaultValue,
-		},
-		{
-			name:     "valid port is parsed",
-			set:      true,
-			value:    "9000",
-			expected: 9000,
-		},
-		{
-			name:     "highest port is accepted",
-			set:      true,
-			value:    "65535",
-			expected: 65535,
-		},
-		{
-			name:        "unparseable value is rejected",
-			set:         true,
-			value:       "not-a-port",
-			expectError: true,
-		},
-		{
-			name:        "zero is rejected",
-			set:         true,
-			value:       "0",
-			expectError: true,
-			errIs:       config.ErrNonPositiveValue,
-		},
-		{
-			name:        "above the port range is rejected",
-			set:         true,
-			value:       "65536",
-			expectError: true,
-			errIs:       config.ErrInvalidPort,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Cannot use t.Parallel() here because t.Setenv
-			// is incompatible with parallel subtests.
-			if tt.set {
-				t.Setenv(testEnvKey, tt.value)
-			} else {
-				require.NoError(t, os.Unsetenv(testEnvKey))
-			}
-
-			got, err := config.EnvPortForTest(
-				testEnvKey, defaultValue,
-			)
-
-			if tt.expectError {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), testEnvKey)
-
-				if tt.errIs != nil {
-					require.ErrorIs(t, err, tt.errIs)
-				}
-
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}
-
-// buildConfig constructs a Config through fx exactly as the
-// application does, returning the config and any construction error.
-func buildConfig(t *testing.T) (*config.Config, error) {
-	t.Helper()
-
-	var cfg *config.Config
-
-	app := fx.New(
-		fx.NopLogger,
-		fx.Provide(
-			globals.New,
-			logger.New,
-			config.New,
-		),
-		fx.Populate(&cfg),
-	)
-
-	return cfg, app.Err()
-}
-
-func TestNewRejectsBadEnvValues(t *testing.T) {
-	tests := []struct {
-		name        string
-		key         string
-		value       string
-		expectError bool
-		check       func(t *testing.T, cfg *config.Config)
-	}{
-		{
-			name:  "valid PORT is used",
-			key:   envKeyPort,
-			value: "9001",
-			check: func(t *testing.T, cfg *config.Config) {
-				t.Helper()
-				assert.Equal(t, 9001, cfg.Port)
-			},
-		},
-		{
-			name:        "unparseable PORT aborts startup",
-			key:         envKeyPort,
-			value:       "eighty-eighty",
-			expectError: true,
-		},
-		{
-			name:        "out-of-range PORT aborts startup",
-			key:         envKeyPort,
-			value:       "70000",
-			expectError: true,
-		},
-		{
-			name:  "valid DEBUG is used",
-			key:   envKeyDebug,
-			value: "true",
-			check: func(t *testing.T, cfg *config.Config) {
-				t.Helper()
-				assert.True(t, cfg.Debug)
-			},
-		},
-		{
-			name:        "unparseable DEBUG aborts startup",
-			key:         envKeyDebug,
-			value:       "ture",
-			expectError: true,
-		},
-		{
-			name:        "unparseable MAINTENANCE_MODE aborts startup",
-			key:         envKeyMaintenanceMode,
-			value:       "sometimes",
-			expectError: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Cannot use t.Parallel() here because t.Setenv
-			// is incompatible with parallel subtests.
-			t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
-			t.Setenv(tt.key, tt.value)
-
-			cfg, err := buildConfig(t)
-
-			if tt.expectError {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), tt.key)
-				assert.Contains(t, err.Error(), tt.value)
-
-				return
-			}
-
-			require.NoError(t, err)
-			require.NotNil(t, cfg)
-			tt.check(t, cfg)
-		})
-	}
-}
-
-// TestNewUsesDefaultsWhenUnset proves the fail-loud behaviour did not
-// break the legitimate unset case: absent variables still get their
-// documented defaults.
-func TestNewUsesDefaultsWhenUnset(t *testing.T) {
-	t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
-
-	for _, key := range []string{
-		envKeyPort, envKeyDebug, envKeyMaintenanceMode,
-	} {
-		require.NoError(t, os.Unsetenv(key))
-	}
-
-	cfg, err := buildConfig(t)
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
-	assert.Equal(t, 8080, cfg.Port)
-	assert.False(t, cfg.Debug)
-	assert.False(t, cfg.MaintenanceMode)
-}

internal/config/export_test.go

@@ -1,20 +0,0 @@
-package config
-
-// This file exposes the unexported environment parsing helpers to
-// the external config_test package so each helper can be covered by
-// its own table-driven test without weakening the package API.
-
-// EnvBoolForTest exposes envBool.
-func EnvBoolForTest(key string, defaultValue bool) (bool, error) {
-	return envBool(key, defaultValue)
-}
-
-// EnvPositiveIntForTest exposes envPositiveInt.
-func EnvPositiveIntForTest(key string, defaultValue int) (int, error) {
-	return envPositiveInt(key, defaultValue)
-}
-
-// EnvPortForTest exposes envPort.
-func EnvPortForTest(key string, defaultValue int) (int, error) {
-	return envPort(key, defaultValue)
-}

internal/middleware/middleware.go

@@ -186,6 +186,10 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 				return
 			}
 
+			// IsAuthenticated also enforces both session expiry
+			// deadlines, so an idle-expired or absolutely-expired
+			// session lands here and is sent back to the login
+			// page.
 			if !s.session.IsAuthenticated(sess) {
 				s.log.Debug(
 					"auth middleware: unauthenticated request",
@@ -199,6 +203,26 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 				return
 			}
 
+			// This request authenticated with the session, so it
+			// counts as activity: push the idle deadline forward.
+			// This is the only place sessions are refreshed, which
+			// is what keeps an unauthenticated request from
+			// extending someone else's session. Touch advances the
+			// idle clock only -- the absolute cap is untouched --
+			// and reports false when nothing changed, so most
+			// requests do not re-issue the cookie. Save before the
+			// handler runs, while the headers are still ours to
+			// write.
+			if s.session.Touch(sess) {
+				err = s.session.Save(r, w, sess)
+				if err != nil {
+					s.log.Error(
+						"auth middleware: failed to refresh session",
+						"error", err,
+					)
+				}
+			}
+
 			next.ServeHTTP(w, r)
 		})
 	}

internal/middleware/middleware_test.go

@@ -8,6 +8,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"testing"
+	"time"
 
 	"github.com/gorilla/sessions"
 	"github.com/stretchr/testify/assert"
@@ -28,6 +29,22 @@ func testMiddleware(
 ) (*middleware.Middleware, *session.Session) {
 	t.Helper()
 
+	m, s, _ := testMiddlewareWithSessionClock(t, env, 0, nil)
+
+	return m, s
+}
+
+// testMiddlewareWithSessionClock is testMiddleware with a
+// configurable session idle timeout and a manually advanced clock,
+// for the session-expiry tests. A nil clock uses the real one.
+func testMiddlewareWithSessionClock(
+	t *testing.T,
+	env string,
+	idleTimeout time.Duration,
+	clock *fakeClock,
+) (*middleware.Middleware, *session.Session, *fakeClock) {
+	t.Helper()
+
 	log := slog.New(slog.NewTextHandler(
 		os.Stderr,
 		&slog.HandlerOptions{Level: slog.LevelDebug},
@@ -35,6 +52,7 @@ func testMiddleware(
 
 	cfg := &config.Config{
 		Environment:        env,
+		SessionIdleTimeout: idleTimeout,
 	}
 
 	// Create a real session manager with a known key
@@ -53,11 +71,40 @@ func testMiddleware(
 		SameSite: http.SameSiteLaxMode,
 	}
 
-	sessManager := session.NewForTest(store, cfg, log, key)
+	var now func() time.Time
+
+	if clock != nil {
+		now = clock.Now
+	}
+
+	sessManager := session.NewForTest(store, cfg, log, key, now)
 
 	m := middleware.NewForTest(log, cfg, sessManager)
 
-	return m, sessManager
+	return m, sessManager, clock
+}
+
+// fakeClock is a manually advanced clock, so session expiry can be
+// tested without sleeping.
+type fakeClock struct {
+	t time.Time
+}
+
+func (c *fakeClock) Now() time.Time {
+	return c.t
+}
+
+func (c *fakeClock) Advance(d time.Duration) {
+	c.t = c.t.Add(d)
+}
+
+// newFakeClock returns a clock started at a fixed instant.
+func newFakeClock() *fakeClock {
+	return &fakeClock{
+		t: time.Date(
+			2026, time.January, 2, 3, 4, 5, 0, time.UTC,
+		),
+	}
 }
 
 // --- Logging Middleware Tests ---
@@ -387,6 +434,181 @@ func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
+// --- RequireAuth Session Expiry Tests ---
+
+// loginCookies authenticates a new session and returns the cookies
+// a browser would then send back.
+func loginCookies(
+	t *testing.T,
+	sessManager *session.Session,
+) []*http.Cookie {
+	t.Helper()
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/login", nil)
+	w := httptest.NewRecorder()
+
+	sess, err := sessManager.Get(req)
+	require.NoError(t, err)
+	sessManager.SetUser(sess, "user-123", "testuser")
+	require.NoError(t, sessManager.Save(req, w, sess))
+
+	cookies := w.Result().Cookies()
+	require.NotEmpty(t, cookies, "session cookie should be set")
+
+	return cookies
+}
+
+// runAuthed sends a request carrying cookies through RequireAuth
+// and reports whether the protected handler ran, plus the response.
+func runAuthed(
+	t *testing.T,
+	m *middleware.Middleware,
+	cookies []*http.Cookie,
+) (bool, *httptest.ResponseRecorder) {
+	t.Helper()
+
+	var called bool
+
+	handler := m.RequireAuth()(http.HandlerFunc(
+		func(_ http.ResponseWriter, _ *http.Request) {
+			called = true
+		},
+	))
+
+	req := httptest.NewRequestWithContext(
+		context.Background(),
+		http.MethodGet, "/dashboard", nil,
+	)
+
+	for _, c := range cookies {
+		req.AddCookie(c)
+	}
+
+	w := httptest.NewRecorder()
+	handler.ServeHTTP(w, req)
+
+	return called, w
+}
+
+// sessionCookies filters a response's cookies down to the session
+// cookie, so tests can tell whether the session was re-issued.
+func sessionCookies(
+	w *httptest.ResponseRecorder,
+) []*http.Cookie {
+	var out []*http.Cookie
+
+	for _, c := range w.Result().Cookies() {
+		if c.Name == session.SessionName {
+			out = append(out, c)
+		}
+	}
+
+	return out
+}
+
+func TestRequireAuth_IdleExpiredSession_RedirectsToLogin(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	idle := time.Hour
+
+	m, sessManager, clock := testMiddlewareWithSessionClock(
+		t, config.EnvironmentDev, idle, newFakeClock(),
+	)
+
+	cookies := loginCookies(t, sessManager)
+
+	clock.Advance(idle)
+
+	called, w := runAuthed(t, m, cookies)
+
+	assert.False(
+		t, called,
+		"handler should not run for an idle-expired session",
+	)
+	assert.Equal(t, http.StatusSeeOther, w.Code)
+	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
+	assert.Empty(
+		t, sessionCookies(w),
+		"an expired session must not be refreshed",
+	)
+}
+
+func TestRequireAuth_RefreshesIdleDeadlineOnActivity(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	idle := time.Hour
+
+	m, sessManager, clock := testMiddlewareWithSessionClock(
+		t, config.EnvironmentDev, idle, newFakeClock(),
+	)
+
+	cookies := loginCookies(t, sessManager)
+
+	// Activity halfway through the idle window.
+	clock.Advance(idle / 2)
+
+	called, w := runAuthed(t, m, cookies)
+	require.True(t, called, "handler should run while valid")
+
+	refreshed := sessionCookies(w)
+	require.NotEmpty(
+		t, refreshed,
+		"activity should re-issue the session cookie",
+	)
+
+	// Past the original deadline. The refreshed cookie is still
+	// good; the original one is not.
+	clock.Advance(idle - time.Second)
+
+	calledRefreshed, _ := runAuthed(t, m, refreshed)
+	assert.True(
+		t, calledRefreshed,
+		"refreshed session should outlive the original deadline",
+	)
+
+	calledStale, staleW := runAuthed(t, m, cookies)
+	assert.False(
+		t, calledStale,
+		"the pre-refresh cookie carries the old idle deadline",
+	)
+	assert.Equal(t, http.StatusSeeOther, staleW.Code)
+}
+
+func TestRequireAuth_UnauthenticatedRequestDoesNotRefresh(
+	t *testing.T,
+) {
+	t.Parallel()
+
+	m, sessManager, _ := testMiddlewareWithSessionClock(
+		t, config.EnvironmentDev, time.Hour, newFakeClock(),
+	)
+
+	// A session cookie that exists but was never authenticated.
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/setup", nil)
+	setupW := httptest.NewRecorder()
+
+	sess, err := sessManager.Get(req)
+	require.NoError(t, err)
+	require.NoError(t, sessManager.Save(req, setupW, sess))
+
+	cookies := setupW.Result().Cookies()
+	require.NotEmpty(t, cookies)
+
+	called, w := runAuthed(t, m, cookies)
+
+	assert.False(t, called)
+	assert.Empty(
+		t, sessionCookies(w),
+		"an unauthenticated request must not stamp the session",
+	)
+}
+
 // --- NoCache Middleware Tests ---
 
 func TestNoCache_SetsHeaders(t *testing.T) {
@@ -479,7 +701,7 @@ func metricsAuthMiddleware(
 	store := sessions.NewCookieStore(key)
 	store.Options = &sessions.Options{Path: "/", MaxAge: 86400}
 
-	sessManager := session.NewForTest(store, cfg, log, key)
+	sessManager := session.NewForTest(store, cfg, log, key, nil)
 
 	return middleware.NewForTest(log, cfg, sessManager)
 }

internal/session/session.go

@@ -10,6 +10,7 @@ import (
 	"log/slog"
 	"maps"
 	"net/http"
+	"time"
 
 	"github.com/gorilla/sessions"
 	"go.uber.org/fx"
@@ -32,6 +33,18 @@ const (
 	// status.
 	AuthenticatedKey = "authenticated"
 
+	// CreatedAtKey is the session key holding the Unix timestamp at
+	// which the session was authenticated. It anchors the ABSOLUTE
+	// expiry clock and is written exactly once, by SetUser. Nothing
+	// refreshes it: an absolute deadline that moved with activity
+	// would not be a cap at all.
+	CreatedAtKey = "created_at"
+
+	// LastSeenKey is the session key holding the Unix timestamp of
+	// the most recent authenticated request. It anchors the IDLE
+	// expiry clock and is pushed forward by Touch.
+	LastSeenKey = "last_seen"
+
 	// sessionKeyLength is the required length in bytes for the
 	// session authentication key.
 	sessionKeyLength = 32
@@ -41,6 +54,19 @@ const (
 
 	// secondsPerDay is the number of seconds in a day.
 	secondsPerDay = 86400
+
+	// sessionAbsoluteMaxAge is the hard upper bound on how long a
+	// session may live, measured from CreatedAtKey. Activity never
+	// extends it, so even a continuously used session ends here and
+	// the user has to authenticate again.
+	sessionAbsoluteMaxAge = sessionMaxAgeDays * secondsPerDay * time.Second
+
+	// idleRefreshDivisor rate-limits idle-deadline refreshes. Touch
+	// only rewrites LastSeenKey once the stored value is older than
+	// idleTimeout/idleRefreshDivisor, so an active session is
+	// re-saved at most this many times per idle window instead of
+	// once per request. See Touch for the tradeoff this buys.
+	idleRefreshDivisor = 10
 )
 
 // ErrSessionKeyLength is returned when the decoded session key
@@ -62,6 +88,16 @@ type Session struct {
 	key    []byte // raw 32-byte auth key, also used for CSRF cookie signing
 	log    *slog.Logger
 	config *config.Config
+
+	// idleTimeout is the sliding inactivity window. A session that
+	// sees no authenticated request within this window expires,
+	// independently of the absolute cap. Non-positive disables idle
+	// expiry and leaves sessionAbsoluteMaxAge as the only bound.
+	idleTimeout time.Duration
+
+	// now reads the current time. Injected so expiry can be tested
+	// without sleeping.
+	now func() time.Time
 }
 
 // New creates a new session manager. The cookie store is
@@ -75,6 +111,8 @@ func New(
 	s := &Session{
 		log:         params.Logger.Get(),
 		config:      params.Config,
+		idleTimeout: params.Config.SessionIdleTimeout,
+		now:         time.Now,
 	}
 
 	lc.Append(fx.Hook{
@@ -149,29 +187,98 @@ func (s *Session) Save(
 	return sess.Save(r, w)
 }
 
-// SetUser sets the user information in the session.
+// SetUser sets the user information in the session. It starts both
+// expiry clocks: CreatedAtKey (absolute, never refreshed again) and
+// LastSeenKey (idle, refreshed by Touch).
 func (s *Session) SetUser(
 	sess *sessions.Session,
 	userID, username string,
 ) {
+	now := s.now().Unix()
+
 	sess.Values[UserIDKey] = userID
 	sess.Values[UsernameKey] = username
 	sess.Values[AuthenticatedKey] = true
+	sess.Values[CreatedAtKey] = now
+	sess.Values[LastSeenKey] = now
 }
 
-// ClearUser removes user information from the session.
+// ClearUser removes user information from the session, including
+// both expiry timestamps.
 func (s *Session) ClearUser(sess *sessions.Session) {
 	delete(sess.Values, UserIDKey)
 	delete(sess.Values, UsernameKey)
 	delete(sess.Values, AuthenticatedKey)
+	delete(sess.Values, CreatedAtKey)
+	delete(sess.Values, LastSeenKey)
 }
 
-// IsAuthenticated checks if the session has an authenticated
-// user.
+// sessionTime reads a Unix-second timestamp stored under key.
+func sessionTime(
+	sess *sessions.Session,
+	key string,
+) (time.Time, bool) {
+	secs, ok := sess.Values[key].(int64)
+	if !ok {
+		return time.Time{}, false
+	}
+
+	return time.Unix(secs, 0), true
+}
+
+// IsAuthenticated checks if the session has an authenticated user
+// whose session has not passed either expiry deadline. Every
+// authentication decision goes through here, so neither clock can
+// be bypassed by a caller that forgets to check it.
 func (s *Session) IsAuthenticated(sess *sessions.Session) bool {
 	auth, ok := sess.Values[AuthenticatedKey].(bool)
+	if !ok || !auth {
+		return false
+	}
 
-	return ok && auth
+	return !s.expired(sess)
+}
+
+// Touch records authenticated activity by pushing the IDLE deadline
+// forward. It writes LastSeenKey only; CreatedAtKey is left alone so
+// the absolute cap keeps counting down even for a user who never
+// stops clicking.
+//
+// Callers must only invoke Touch for a request that authenticated
+// with this session. Refreshing on an unauthenticated request would
+// let anyone holding a stolen or abandoned cookie keep the session
+// alive by polling a public endpoint. Touch enforces that itself by
+// returning false for any session that is not currently
+// authenticated and unexpired.
+//
+// To avoid re-encrypting and re-emitting the session cookie on every
+// single request, the timestamp is advanced only once it is older
+// than idleTimeout/idleRefreshDivisor. The tradeoff is that
+// LastSeenKey lags real activity by up to that much, so a session
+// can expire slightly early relative to the user's true last
+// request -- never late.
+//
+// Touch reports whether it changed the session; only then does the
+// caller need to save it.
+func (s *Session) Touch(sess *sessions.Session) bool {
+	if s.idleTimeout <= 0 {
+		return false
+	}
+
+	if !s.IsAuthenticated(sess) {
+		return false
+	}
+
+	now := s.now()
+
+	lastSeen, ok := sessionTime(sess, LastSeenKey)
+	if ok && now.Sub(lastSeen) < s.idleTimeout/idleRefreshDivisor {
+		return false
+	}
+
+	sess.Values[LastSeenKey] = now.Unix()
+
+	return true
 }
 
 // GetUserID retrieves the user ID from the session.
@@ -253,3 +360,41 @@ func (s *Session) Regenerate(
 
 	return newSess, nil
 }
+
+// expired reports whether the session has passed either of its two
+// independent deadlines. They are deliberately kept apart:
+//
+//   - the ABSOLUTE deadline is CreatedAtKey + sessionAbsoluteMaxAge.
+//     It is fixed at login and no amount of activity moves it.
+//   - the IDLE deadline is LastSeenKey + idleTimeout. Activity moves
+//     it forward via Touch.
+//
+// Whichever comes first ends the session.
+//
+// A session that claims to be authenticated but carries no
+// timestamps predates this check; it is treated as expired so the
+// user re-authenticates rather than being granted an unbounded
+// session.
+func (s *Session) expired(sess *sessions.Session) bool {
+	now := s.now()
+
+	createdAt, ok := sessionTime(sess, CreatedAtKey)
+	if !ok {
+		return true
+	}
+
+	if !now.Before(createdAt.Add(sessionAbsoluteMaxAge)) {
+		return true
+	}
+
+	if s.idleTimeout <= 0 {
+		return false
+	}
+
+	lastSeen, ok := sessionTime(sess, LastSeenKey)
+	if !ok {
+		return true
+	}
+
+	return !now.Before(lastSeen.Add(s.idleTimeout))
+}

internal/session/session_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"testing"
+	"time"
 
 	"github.com/gorilla/sessions"
 	"github.com/stretchr/testify/assert"
@@ -17,11 +18,47 @@ import (
 
 const testKeySize = 32
 
-// testSession creates a Session with a real cookie store for
-// testing.
+// testIdleTimeout is the idle window used by the expiry tests.
+const testIdleTimeout = time.Hour
+
+// testAbsoluteMaxAge restates the documented absolute session cap
+// independently of the implementation constant.
+const testAbsoluteMaxAge = 7 * 24 * time.Hour
+
+// fakeClock is a manually advanced clock, so expiry can be tested
+// without sleeping.
+type fakeClock struct {
+	t time.Time
+}
+
+func (c *fakeClock) Now() time.Time {
+	return c.t
+}
+
+func (c *fakeClock) Advance(d time.Duration) {
+	c.t = c.t.Add(d)
+}
+
+// testSession creates a Session with a real cookie store and the
+// real clock.
 func testSession(t *testing.T) *session.Session {
 	t.Helper()
 
+	s, _ := testSessionWithClock(t, testIdleTimeout, nil)
+
+	return s
+}
+
+// testSessionWithClock creates a Session with a real cookie store,
+// the given idle timeout, and a manually advanced clock. Passing a
+// nil clock uses the real one.
+func testSessionWithClock(
+	t *testing.T,
+	idleTimeout time.Duration,
+	clock *fakeClock,
+) (*session.Session, *fakeClock) {
+	t.Helper()
+
 	key := make([]byte, testKeySize)
 
 	for i := range key {
@@ -39,6 +76,7 @@ func testSession(t *testing.T) *session.Session {
 
 	cfg := &config.Config{
 		Environment:        config.EnvironmentDev,
+		SessionIdleTimeout: idleTimeout,
 	}
 
 	log := slog.New(slog.NewTextHandler(
@@ -46,7 +84,46 @@ func testSession(t *testing.T) *session.Session {
 		&slog.HandlerOptions{Level: slog.LevelDebug},
 	))
 
-	return session.NewForTest(store, cfg, log, key)
+	var now func() time.Time
+
+	if clock != nil {
+		now = clock.Now
+	}
+
+	return session.NewForTest(store, cfg, log, key, now), clock
+}
+
+// newFakeClock returns a clock started at a fixed instant.
+func newFakeClock() *fakeClock {
+	return &fakeClock{
+		t: time.Date(
+			2026, time.January, 2, 3, 4, 5, 0, time.UTC,
+		),
+	}
+}
+
+// authenticatedSession returns a fresh session that has just been
+// logged in, along with its manager and clock.
+func authenticatedSession(
+	t *testing.T,
+	idleTimeout time.Duration,
+) (*session.Session, *sessions.Session, *fakeClock) {
+	t.Helper()
+
+	s, clock := testSessionWithClock(
+		t, idleTimeout, newFakeClock(),
+	)
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
+
+	sess, err := s.Get(req)
+	require.NoError(t, err)
+
+	s.SetUser(sess, "user-123", "alice")
+	require.True(t, s.IsAuthenticated(sess))
+
+	return s, sess, clock
 }
 
 // --- Get and Save Tests ---
@@ -430,6 +507,263 @@ func TestSessionConstants(t *testing.T) {
 	assert.Equal(t, "user_id", session.UserIDKey)
 	assert.Equal(t, "username", session.UsernameKey)
 	assert.Equal(t, "authenticated", session.AuthenticatedKey)
+	assert.Equal(t, "created_at", session.CreatedAtKey)
+	assert.Equal(t, "last_seen", session.LastSeenKey)
+}
+
+// --- Expiry Tests ---
+
+func TestSetUser_StartsBothClocks(t *testing.T) {
+	t.Parallel()
+
+	_, sess, clock := authenticatedSession(t, testIdleTimeout)
+
+	assert.Equal(
+		t, clock.Now().Unix(), sess.Values[session.CreatedAtKey],
+		"SetUser should anchor the absolute clock",
+	)
+	assert.Equal(
+		t, clock.Now().Unix(), sess.Values[session.LastSeenKey],
+		"SetUser should anchor the idle clock",
+	)
+}
+
+func TestIsAuthenticated_WithinIdleWindow(t *testing.T) {
+	t.Parallel()
+
+	s, sess, clock := authenticatedSession(t, testIdleTimeout)
+
+	clock.Advance(testIdleTimeout - time.Second)
+
+	assert.True(
+		t, s.IsAuthenticated(sess),
+		"session should still be valid just inside the idle window",
+	)
+}
+
+func TestIsAuthenticated_IdleExpired(t *testing.T) {
+	t.Parallel()
+
+	s, sess, clock := authenticatedSession(t, testIdleTimeout)
+
+	clock.Advance(testIdleTimeout)
+
+	assert.False(
+		t, s.IsAuthenticated(sess),
+		"session should expire once the idle window lapses",
+	)
+}
+
+// TestTouch_DoesNotExtendAbsoluteCap is the regression test for the
+// refresh-the-wrong-clock bug: a session that is used continuously
+// must survive well past the idle window and still die at the
+// absolute cap.
+func TestTouch_DoesNotExtendAbsoluteCap(t *testing.T) {
+	t.Parallel()
+
+	s, sess, clock := authenticatedSession(t, testIdleTimeout)
+
+	createdAt := sess.Values[session.CreatedAtKey]
+
+	// Stay active: a request every half idle window, right up to
+	// the absolute cap.
+	step := testIdleTimeout / 2
+	steps := int(testAbsoluteMaxAge/step) - 1
+
+	for i := range steps {
+		clock.Advance(step)
+		s.Touch(sess)
+
+		require.True(
+			t, s.IsAuthenticated(sess),
+			"active session should survive the idle window "+
+				"(step %d of %d)", i+1, steps,
+		)
+	}
+
+	// One more step of activity takes the session to exactly the
+	// absolute cap, measured from login. Nothing that happened in
+	// the loop may have moved that deadline.
+	clock.Advance(step)
+	s.Touch(sess)
+
+	assert.False(
+		t, s.IsAuthenticated(sess),
+		"activity must not extend the absolute cap",
+	)
+	assert.Equal(
+		t, createdAt, sess.Values[session.CreatedAtKey],
+		"Touch must never rewrite the absolute-clock anchor",
+	)
+}
+
+func TestTouch_RefreshesIdleDeadline(t *testing.T) {
+	t.Parallel()
+
+	s, sess, clock := authenticatedSession(t, testIdleTimeout)
+
+	// Halfway through the window, activity happens.
+	clock.Advance(testIdleTimeout / 2)
+	assert.True(
+		t, s.Touch(sess),
+		"Touch should refresh once past the lazy-refresh threshold",
+	)
+
+	// Past the original deadline, but inside the refreshed one.
+	clock.Advance(testIdleTimeout - time.Second)
+	assert.True(
+		t, s.IsAuthenticated(sess),
+		"refreshed session should outlive the original deadline",
+	)
+
+	// And it still expires an idle window after that activity.
+	clock.Advance(time.Second)
+	assert.False(
+		t, s.IsAuthenticated(sess),
+		"refreshed session should expire one window after activity",
+	)
+}
+
+func TestTouch_LazyBelowRefreshThreshold(t *testing.T) {
+	t.Parallel()
+
+	s, sess, clock := authenticatedSession(t, testIdleTimeout)
+
+	before := sess.Values[session.LastSeenKey]
+
+	// A request arriving almost immediately is not worth a cookie
+	// rewrite.
+	clock.Advance(time.Second)
+
+	assert.False(
+		t, s.Touch(sess),
+		"Touch should not rewrite the session below the threshold",
+	)
+	assert.Equal(
+		t, before, sess.Values[session.LastSeenKey],
+		"last-seen should be unchanged below the threshold",
+	)
+}
+
+func TestTouch_UnauthenticatedSessionIsNotRefreshed(t *testing.T) {
+	t.Parallel()
+
+	s, clock := testSessionWithClock(
+		t, testIdleTimeout, newFakeClock(),
+	)
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
+
+	sess, err := s.Get(req)
+	require.NoError(t, err)
+
+	clock.Advance(testIdleTimeout / 2)
+
+	assert.False(
+		t, s.Touch(sess),
+		"an unauthenticated session must not be refreshed",
+	)
+
+	_, hasLastSeen := sess.Values[session.LastSeenKey]
+	assert.False(
+		t, hasLastSeen,
+		"Touch must not stamp an unauthenticated session",
+	)
+}
+
+func TestTouch_IdleExpiredSessionIsNotRevived(t *testing.T) {
+	t.Parallel()
+
+	s, sess, clock := authenticatedSession(t, testIdleTimeout)
+
+	clock.Advance(testIdleTimeout)
+	require.False(t, s.IsAuthenticated(sess))
+
+	assert.False(
+		t, s.Touch(sess),
+		"an already expired session must not be refreshed",
+	)
+	assert.False(
+		t, s.IsAuthenticated(sess),
+		"Touch must not revive an expired session",
+	)
+}
+
+func TestIsAuthenticated_MissingTimestamps(t *testing.T) {
+	t.Parallel()
+
+	s, _ := testSessionWithClock(
+		t, testIdleTimeout, newFakeClock(),
+	)
+
+	req := httptest.NewRequestWithContext(
+		context.Background(), http.MethodGet, "/", nil)
+
+	sess, err := s.Get(req)
+	require.NoError(t, err)
+
+	// A session from before idle expiry existed: authenticated,
+	// but with no timestamps. Fail closed.
+	sess.Values[session.AuthenticatedKey] = true
+
+	assert.False(
+		t, s.IsAuthenticated(sess),
+		"a session with no timestamps should be rejected",
+	)
+}
+
+func TestIsAuthenticated_MissingLastSeen(t *testing.T) {
+	t.Parallel()
+
+	s, sess, _ := authenticatedSession(t, testIdleTimeout)
+
+	delete(sess.Values, session.LastSeenKey)
+
+	assert.False(
+		t, s.IsAuthenticated(sess),
+		"a session with no idle anchor should be rejected",
+	)
+}
+
+func TestIdleTimeoutDisabled_AbsoluteCapStillApplies(t *testing.T) {
+	t.Parallel()
+
+	s, sess, clock := authenticatedSession(t, 0)
+
+	// Idle expiry is off, so an untouched session survives an
+	// arbitrary idle stretch.
+	clock.Advance(testAbsoluteMaxAge - time.Second)
+	assert.True(
+		t, s.IsAuthenticated(sess),
+		"idle expiry should be disabled by a non-positive timeout",
+	)
+
+	assert.False(
+		t, s.Touch(sess),
+		"Touch should be a no-op when idle expiry is disabled",
+	)
+
+	// The absolute cap still ends it.
+	clock.Advance(time.Second)
+	assert.False(
+		t, s.IsAuthenticated(sess),
+		"the absolute cap must still apply with idle expiry off",
+	)
+}
+
+func TestClearUser_RemovesTimestamps(t *testing.T) {
+	t.Parallel()
+
+	s, sess, _ := authenticatedSession(t, testIdleTimeout)
+
+	s.ClearUser(sess)
+
+	_, hasCreatedAt := sess.Values[session.CreatedAtKey]
+	assert.False(t, hasCreatedAt, "CreatedAtKey should be removed")
+
+	_, hasLastSeen := sess.Values[session.LastSeenKey]
+	assert.False(t, hasLastSeen, "LastSeenKey should be removed")
 }
 
 // --- Edge Cases ---

internal/session/testing.go

@@ -2,6 +2,7 @@ package session
 
 import (
 	"log/slog"
+	"time"
 
 	"github.com/gorilla/sessions"
 	"sneak.berlin/go/webhooker/internal/config"
@@ -12,16 +13,28 @@ import (
 // middleware and handler tests to use real session functionality. The key
 // parameter is the raw 32-byte authentication key used for session encryption
 // and CSRF cookie signing.
+//
+// The idle timeout is taken from cfg.SessionIdleTimeout, exactly as in
+// production. The now parameter supplies the clock used for expiry
+// checks so tests can advance time without sleeping; pass nil for the
+// real clock.
 func NewForTest(
 	store *sessions.CookieStore,
 	cfg *config.Config,
 	log *slog.Logger,
 	key []byte,
+	now func() time.Time,
 ) *Session {
+	if now == nil {
+		now = time.Now
+	}
+
 	return &Session{
 		store:       store,
 		key:         key,
 		config:      cfg,
 		log:         log,
+		idleTimeout: cfg.SessionIdleTimeout,
+		now:         now,
 	}
 }