Live change already applied 2026-10-20: the authentik login-session TTL was raised from the 24 h default to 7 days (stage default-authentication-login.session_duration = "days=7"). This PR records it and makes it reproducible.
Authentik.md: new Login-session lifetime section — the knob (UserLoginStage.session_duration, not a global setting, not SESSION_COOKIE_AGE), absolute-not-sliding (no SESSION_SAVE_EVERY_REQUEST in authentik), the string-idiom trap (a timedelta stores a form the parser rejects and crashes login), apply-every-login / overrides browser-close, DB-state drift note. Page trimmed back under the OKF 500 cap (494 lines).
scripts/authentik-set-login-session-duration.sh: idempotent setter that validates the days=7 form before writing, so nobody re-introduces the ValueError crash.
The SearXNG agent-endpoint fix from the same investigation is a harness-config change (not this repo), applied separately.
Live change already applied 2026-10-20: the authentik login-session TTL was raised from the 24 h default to **7 days** (stage `default-authentication-login.session_duration = "days=7"`). This PR records it and makes it reproducible.
- **Authentik.md**: new *Login-session lifetime* section — the knob (UserLoginStage.session_duration, not a global setting, not SESSION_COOKIE_AGE), absolute-not-sliding (no SESSION_SAVE_EVERY_REQUEST in authentik), the string-idiom trap (a timedelta stores a form the parser rejects and crashes login), apply-every-login / overrides browser-close, DB-state drift note. Page trimmed back under the OKF 500 cap (494 lines).
- **scripts/authentik-set-login-session-duration.sh**: idempotent setter that validates the `days=7` form before writing, so nobody re-introduces the ValueError crash.
The SearXNG agent-endpoint fix from the same investigation is a harness-config change (not this repo), applied separately.
tests/run.sh: green (RUN-SH-EXIT=0).
---
cwd: /home/blank/.omp/wt/wt-20261020-125416-6d1fc1f · session: 01a15b5c-ede9-7063-b05b-1ef94188b7c3
The login-session lifetime (raised to days=7 on 2026-10-20) is owned by the
default-authentication-login stage's session_duration, not a global setting and
not SESSION_COOKIE_AGE. Authentik exposes no SESSION_SAVE_EVERY_REQUEST, so the
window is absolute. session_duration is a STRING idiom; a timedelta stores a form
timedelta_from_string rejects, crashing login. Add scripts/authentik-set-login-session-duration.sh
that validates the form before writing (DB state, not repo-managed, re-run after
a blueprint re-import). Trim the page back under the OKF 500-line cap. tests/run.sh green.
dank
merged commit afa3a4521c into main2026-10-20 16:57:29 -07:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Live change already applied 2026-10-20: the authentik login-session TTL was raised from the 24 h default to 7 days (stage
default-authentication-login.session_duration = "days=7"). This PR records it and makes it reproducible.days=7form before writing, so nobody re-introduces the ValueError crash.The SearXNG agent-endpoint fix from the same investigation is a harness-config change (not this repo), applied separately.
tests/run.sh: green (RUN-SH-EXIT=0).
cwd: /home/blank/.omp/wt/wt-20261020-125416-6d1fc1f · session: 01a15b5c-ede9-7063-b05b-1ef94188b7c3