tying off version two
The last few days were the big feature posts, roles and languages. This one is the broom behind them, the small stuff that closes out version two properly.
The front page in Chinese with the dark theme on. Still the same island.
The change tracker is empty for the first time since summer. Every piece of version two is shipped, verified, and filed: the specs that describe how things are supposed to behave now live in one library, nineteen capabilities deep, so the next time I wonder "wait, what did I decide about retention" the answer is written down instead of in my head.
And one fix that deserves its own paragraph, because it annoyed me for weeks before I understood it: the site kept logging me out. Every fifteen minutes or so, gone, log in again. The refresh token that is supposed to keep a session alive for thirty days was there the whole time, sitting in a cookie scoped to the /auth path, which means the browser only sent it on auth requests. Normal page visits never carried it, so the silent renew that runs on every page load never had anything to renew with. The fix is one line at heart:
return &http.Cookie{
Name: "refresh_token",
Value: rawToken,
Path: "/", // was "/auth", which the browser never sent on page visits
HttpOnly: true,
Secure: s.CookieSecure,
SameSite: http.SameSiteStrictMode,
}One line, and then the classic second act: the first version of the fix crashed my test server. With the cookie now visible everywhere, the renew logic also fired while handling auth requests themselves, which triggered another renew, which triggered another. Infinite loop, out of memory, dead server. The guard for that is in too, and I made a point of testing the exact scenario, expired session token, page load, still signed in.
So if the site used to log you out mid-comment: it should not anymore. Log in once and it sticks.