Problem/Motivation

A passphrase-unlocked vault auto-locks after a fixed 30 minutes (a hardcoded backstop in VaultSession), regardless of activity, while the unlock form promises "for this session". That mismatch surprises owners, and the duration cannot be tuned per deployment.

Proposed resolution

  • Add a per-tenant unlock_ttl, plus a site-wide default (pdv.settings:unlock_ttl, shipped 1800).
  • Resolution: the tenant value, else the site default, else a positive backstop. No "stay unlocked forever" - an idle vault always re-locks - but operators may set a multi-day value.
  • Make it an idle timeout with a sliding window: each authenticated vault access extends it (throttled past the halfway mark), so an active owner stays unlocked and an idle one re-locks after unlock_ttl.
  • Surfaces: a "Stay unlocked for" field on the tenant add/edit form, and the site-wide default on the PDV settings form.

Remaining tasks

  • Review.
  • Merge.

Issue fork pdv-3594912

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

mably created an issue. See original summary.

mably opened merge request !37

  • mably committed 436e7d4f on 1.x 
    feat: #3594912 Make the vault unlock duration configurable per tenant,...
mably’s picture

mably commented
Status: Active » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.