[GH] (rocketmq-dashboard/fix/yy-session-idle): Workflow run "CI" failed!

[GitBox <gi...@apache.org>]

The GitHub Actions job "CI" on rocketmq-dashboard.git/fix/yy-session-idle has failed.
Run started by GitHub user yyqdbngt (triggered by yyqdbngt).

Head commit for run:
a58f090741c87fdd1d3f348136d52a47a9db0959 / yyqdbngt <bt...@gmail.com>
feat(auth): enforce a session idle timeout on bearer tokens

A session token stayed valid until its absolute expiry (24 hours by
default) no matter how long it went unused. last_seen_at was tracked,
refreshed and shown as stale after 15 unused minutes, but a stale session
stayed fully authenticated, so a token leaked out of an abandoned browser
was a working credential for up to a day.

Add studio.auth.session-idle-timeout-minutes (default 30, 0 opts out).
databaseUserForToken now revokes and rejects a session whose last use is
older than the window, the five-minute cleanup revokes idle rows so the
active-session views stay truthful even when the abandoned token is never
presented again, and the in-memory mode tracks last-seen per token and
enforces the same window. Values below 10 minutes resolve to 10, above
the five-minute last-seen write throttle, so an active session can never
be idled out by its own throttled writes; out-of-range values fall back to
the default; sessions written before last_seen_at existed keep the
absolute deadline as their only deadline, and the absolute timeout is
unchanged.

Tests: AuthServiceIdleTimeoutTest covers rejection plus revocation, the
in-window session and its last-seen refresh, the write throttle, the 0
opt-out, the minimum resolution, NULL last_seen_at, the scheduled
revocation with the absolute delete, and both in-memory paths.

Report URL: https://github.com/apache/rocketmq-dashboard/actions/runs/36960078815

With regards,
GitHub Actions via GitBox