feat(auth): org session policies — lifetime/idle limits, org-wide revocation

[waleedlatif1]

Summary

• New enterprise org setting: Session policies (org plane, security group) with maxSessionHours (absolute lifetime cap) and idleTimeoutHours (min 24h — session activity is only recorded once per cookie-cache window), plus a Sign out all members action
• Enforcement is in the Better Auth database hooks: session.create.before clamps new sessions, and a new session.update.before hook re-clamps on every sliding refresh (Better Auth rewrites expiresAt to now+30d on refresh, which would silently stretch shortened sessions back out)
• New organization.securityPolicyVersion counter wired into session.cookieCache.version (async fn): bumping it on policy save / revoke-all invalidates every cached session cookie in the org on its next request — revocation latency drops from the 24h cookie-cache lifetime to the ~60s policy-cache TTL. This machinery is shared groundwork for the upcoming IP-allowlisting and MFA-enforcement PRs
• Policy saves also eagerly clamp existing member sessions in SQL (LEAST(expires_at, created_at + max, now() + idle)) so tightening applies without waiting for each session's next refresh
• Impersonation sessions and org-less (personal) sessions are exempt; loosening a policy never extends an existing session
• Migration 0265: two additive columns on organization (session_policy_settings json, security_policy_version int default 1)
• EE-gated like data-retention: enterprise plan on hosted, NEXT_PUBLIC_SESSION_POLICIES_ENABLED override on self-host
• New audit actions: organization.session_policy.updated, organization.sessions.revoked

Requires better-auth 1.6.23 (#5857, merged) for cookieCache.version and the update-hook context.

Known limitation (documented in code): live Socket.IO connections authenticate once at handshake, so revoke-all doesn't disconnect already-open sockets — they die on their next HTTP interaction.

Type of Change

• New feature

Testing

• 15 new tests: clamp math (incl. the sliding-refresh re-clamp regression and idle floor) + route authz/validation/eager-clamp/version-bump
• 730 tests green across lib/auth, api/organizations, components/settings, ee
• Typecheck, lint, check:api-validation, check:migrations all pass
• Not yet live-tested — staging verification list: policy save → member session shortens; revoke-all → member signed out within ~60s; update.before hook context availability against a real refresh

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 22, 2026 11:38pm

[cursor]

PR Summary

High Risk
Changes authentication session lifetime, cookie-cache invalidation, and org-wide revocation—security-critical paths with broad member impact if mis-enforced.

Overview
Adds Enterprise session policies so org owners/admins can set optional max session lifetime and idle timeout (48h minimum), plus Sign out all members from a new Session policies settings screen (org security group, gated like other EE features).

Backend:GET/PUT/api/organizations/[id]/session-policy and POST/api/organizations/[id]/sessions/revoke persist settings on organization.session_policy_settings, bump security_policy_version, eagerly clamp existing member sessions in SQL on save, and revoke all member DB sessions (except caller/impersonation) atomically with a version bump. New security-policy and session-policy modules clamp expiresAt on session create/update, tie cookie-cache version to org membership + policy version, and apply policy when members join, transfer, or leave.

Auth integration: Better Auth hooks re-clamp sliding 30-day refreshes; migration 0265 adds the two org columns. Docs, audit actions, contracts, tests, and NEXT_PUBLIC_SESSION_POLICIES_ENABLED for self-host complete the surface.

^{Reviewed by Cursor Bugbot for commit ba7c70d. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds organization-wide session policies and member session revocation. The main changes are:

• Absolute and idle session lifetime limits.
• Policy enforcement during session creation and refresh.
• Atomic policy updates, eager session clamping, and cache-version bumps.
• Organization-wide member sign-out with transactional revocation.
• Enterprise settings UI, API contracts, migration, audit events, tests, and documentation.

Confidence Score: 5/5

The latest fixes look safe to merge.

• Policy updates and eager session clamping now commit together.
• Session deletion and the security-policy version bump now commit together.
• Organization changes remount the policy form and reset its local state.

Important Files Changed

Filename	Overview
apps/sim/app/api/organizations/[id]/session-policy/route.ts	Stores the policy, increments its version, and clamps existing member sessions in one transaction.
apps/sim/app/api/organizations/[id]/sessions/revoke/route.ts	Deletes eligible member sessions and increments the organization security version in one transaction.
apps/sim/lib/auth/auth.ts	Adds cookie-cache versioning and clamps session expiry during creation and sliding refresh.
apps/sim/lib/auth/session-policy.ts	Implements policy lookup, expiry calculations, and transaction-compatible eager session clamping.
apps/sim/lib/auth/security-policy.ts	Resolves cached organization membership and security-policy versions for session cookie invalidation.
apps/sim/ee/session-policy/components/session-policy-settings.tsx	Adds the policy form and organization-wide member sign-out controls.

_{Reviews (12): Last reviewed commit: "fix(session-policy): unify join paths on..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit ba7c70d. Configure here.}