Skip to content

Allow clear cache sessions - #2472

Open
benidk wants to merge 2 commits into
warp-tech:mainfrom
benidk:feat/allow-clear-cache-sessions
Open

Allow clear cache sessions#2472
benidk wants to merge 2 commits into
warp-tech:mainfrom
benidk:feat/allow-clear-cache-sessions

Conversation

@benidk

@benidk benidk commented Aug 21, 2026

Copy link
Copy Markdown

Description

Following this issue

Administrators had no way to invalidate active authentication-approval bypasses (the cached "remembered web approval" that lets a login skip re-approval for the configured grace period) without waiting it out. This adds that capability, for use during offboarding, a suspected key compromise, or a policy change.

Backend (warpgate-admin, warpgate-core)

  • GET /web-approvals — list currently active (unexpired) cached bypasses,
    aggregated across the cluster.
  • DELETE /web-approvals — clear every cached bypass (global).
  • DELETE /web-approvals/:username — clear all cached bypasses for one user.
  • DELETE /web-approvals/:username/scope — clear a single target's (or,
    via all_targets, every target's) bypass for one user, for row-level
    revoke from the UI.

All mutating endpoints require the config_edit admin permission. The
cache is per-node in-memory, so clears fan out to every other cluster node
(same pattern as session termination), and reads aggregate results from
all nodes too.

Web Admin UI

New "Web approvals" page under Status: lists active bypasses (user,
protocol, target/scope, source IP, granted-at), with:

  • a "Clear all" button,
  • a dropdown of users currently holding a cached bypass, to clear all of
    that user's bypasses,
  • a per-row "Revoke" action that clears only that row's specific
    target/scope rather than the whole user.

Tests

  • Unit tests for the new AuthStateStore / Services methods
    (clear all / clear for user / clear for user+scope / list active).
  • Added the missing AdminApiTestCase entries for the 4 new operations so
    the admin-API permission-coverage test passes.

AI Usage

Choose the level of AI involvement for this PR.

  • Fully vibe coded
  • AI-designed, AI-coded, manually checked
  • Human-designed, AI-coded
  • Human-designed, human-coded (includes AI autocompletions and boilerplate gen)

This is not to block AI contributions but rather to speed up PR review (saves time on trying to deduce the logic behind AI hallucinations).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant