Repository navigation
fix(ui): Consider typing and scrolling as activity for auto logout - #65589
Open
DerDreschner wants to merge 1 commit into
Open
DerDreschner wants to merge 1 commit into
DerDreschner wants to merge 1 commit into
Conversation
With `auto_logout` enabled, only mouse movements and touch inputs were considered an activity. This means that people were logged out after `session_lifetime` if they only type or scroll without moving the mouse itself. With this commit, key presses, text inputs (`beforeinput`, so dictation solutions do work as well) and mouse `wheel` inputs (instead of `scroll` to prevent scripts keeping the session active by e.g. simply scrolling to a new message) count as activity, too. Additionally, the last activity is shared with other tabs at most once per logout check interval now, and a failing storage write no longer throws. It also document and test that apps report activity through a storage event in the same window, which richdocuments relies on. Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: David Dreschner <david.dreschner@nextcloud.com>
DerDreschner
requested review from
kristian-zendato,
pringelmann and
skjnldsv
and removed request for
a team
October 16, 2026 18:08
DerDreschner
added
bug
3. to review
Contributor
Author
|
/backport to stable35 |
Contributor
Author
|
/backport to stable34 |
Contributor
Author
|
/backport to stable33 |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
Static review found no blocking issues, and focused regression tests cover the changes, though they were not executed during review.
0 open findings
What changed in this PR
Improves auto-logout activity detection so keyboard input and wheel scrolling keep sessions active.
Changes:
- Expands activity listeners and captures events stopped by editors.
- Limits cross-tab storage writes and handles write failures.
- Adds regression tests for activity detection, logout timing, and storage behavior.
| File | Description |
|---|---|
| core/src/tests/OC/session-heartbeat.spec.ts | Adds auto-logout regression tests and listener cleanup. |
| core/src/session-heartbeat.ts | Expands activity detection and throttles storage writes safely. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
susnux
reviewed
Oct 16, 2026
Comment on lines
+142
to
+150
| // Capture phase, as editors may stop the propagation of input events | ||
| window.addEventListener('mousemove', markActive, { capture: true }) | ||
| // Touch, pen and clicks, including clicks by assistive technology that do not move the mouse | ||
| window.addEventListener('pointerdown', markActive, { capture: true }) | ||
| window.addEventListener('keydown', markActive, { capture: true }) | ||
| // Text insertion without key events, e.g. dictation | ||
| window.addEventListener('beforeinput', markActive, { capture: true }) | ||
| // Wheel instead of scroll events, as scripts fire scroll events too | ||
| window.addEventListener('wheel', markActive, { capture: true, passive: true }) |
Contributor
There was a problem hiding this comment.
I am unsure if this is not too much of events, did you do a performance analysis?
If there is a bad performance impact here, we might need to trim this down to
- mousemove
- touchstart (mobile)
- keydown (typing or navigating with keyboard)
- wheel (scrolling long documents)
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When using
auto_logout, only mouse movements and touch were considered an activity. In case thesession_lifetimeis set to something relatively short, users can be logged out if they only type for a pretty long time or only use the keyboard to navigate.This is changed with this PR, which now considers the following events an activity:
mousemovepointerdownkeydownbeforeinputwheelThis cover almost every use-case. Known gaps and exceptions that Claude identified:
richdocumentsand uses a storage event in the same window, which is being documented and tested with this PR.Additionally, the last activity is shared with other tabs at most once per logout check interval now, and a failing storage write no longer throws.
Checklist
3. to review, feature component)stable32)AI (if applicable)