Configurable sliding session lifetime + flattened, on-by-default entitlement freshness (v0.5.0)

[sergeychernyshev]

Why

Patreon-logged-in users were forced to re-authenticate roughly daily — a hardcoded 24h session with no renewal. Fixing it surfaced that login lifetime (authentication) and entitlement freshness (authorization) were conflated; this PR separates them and cleans up the freshness config API.

What changed

Sessions

• Configurable, rolling session TTL via session: { ttl }, default 30 days. Sliding renewal in validateSession pushes expires_at forward once less than half the window remains (≈one write per ½·TTL of activity). Active users effectively never re-login; idle sessions still expire.
• session_id is now a persistent (Max-Age) cookie and the refreshed Max-Age is re-issued on the proxy hot path. Cookie string centralized in sessionSetCookie.

Entitlement freshness — flatter, on-by-default, time-valued

• Flattened & renamed (⚠️ breaking vs 0.4.5): freshness: { ttl, cron, webhook } → per-provider entitlementTtl / entitlementCron / entitlementWebhook.
• entitlementTtl is ON by default for entitlement providers (1 day for Patreon, 15 min otherwise) — every deployment gets a freshness backstop now that sessions are long-lived. entitlementTtl: false disables it (webhook-only).
• Durations are a time, not a boolean: a named-unit object ({ days: 30 }, { minutes: 15 } — summed) or a plain number of ms, via a shared Duration + durationToMs(). Applied to both session.ttl and entitlementTtl.

createStartupAPI({
  session: { ttl: { days: 30 } },
  providers: {
    patreon: {
      // entitlementTtl defaults to { days: 1 } — omit it, tune it, or set false
      entitlementWebhook: true,
    },
  },
});

Behavior / breaking changes (for release notes)

• Breaking: freshness.* config removed → entitlementTtl / entitlementCron / entitlementWebhook.
• entitlementTtl default: off → on (1 day Patreon / 15 min other).
• Default session lifetime: fixed 24h → rolling 30 days; session_id → persistent cookie.

Tests

139 pass + eslint clean. Coverage added for: custom/sliding/no-renew session TTL (userdo), persistent + renewal Set-Cookie on the proxy path (headers), factory config resolution, 30-day default, named-unit durations, durationToMs (factory), and the on-by-default Patreon 1-day entitlement TTL (entitlement_integration).

Versioning

Bumped 0.4.5 → **0.5.0** — the freshness rename is a breaking config change, so a minor bump (pre-1.0) rather than a patch. Say the word if you'd rather keep freshness as a deprecated alias to avoid the break.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	startup-api	a1cc4d7	Jul 03 2026, 07:06 PM