Validate enforced sessions and document migration

MA
2d ago
+845-50

Exercise session ownership in real servers and browsers, migrate synthetic clients to server-issued credentials, and document deployment and rollout.

The backend-path app runs under enforcement across development/production and zero/one/two-level prefixes. It covers immediate hydration during held cookie exchange, shared/duplicate tabs, uploads, failed exchange recovery with retained or cancelled uploads, idle short-TTL renewal, backend restarts, and cross-site iframe persistence. EmbedPlugin coverage also runs under enforcement. Production restarts preserve their worker and compile-suppression settings.

A real Granian test verifies state events while cookie exchange is held and state continuity on reconnect. It uses rx.State and asserts it leaves no direct BaseState subclass behind for later integration apps. Benchmark reconnects reuse cookies and bound tokens, with issuance outside measured event latency.

The guide covers app-bound credentials, persistent/rotating signing keys, POSIX permissions and Windows ACLs, origin configuration, partitioned cookies, embedding, migration modes, SYSTEM/anonymous authority, idle renewal, retry/cancellation, and readiness during cookie replacement. Existing reverse-proxy/api_transformer facilities handle rate limiting.

Review order: #7361 → #7362 → #7363 → #7364. Rebased on main d02ba5409; #7360 is already merged. Companion: reflex-dev/reflex-enterprise#240.

Validation:

  • Full unit suite: 12,147 passed, 26 skipped; 80.15% coverage (72% required).
  • Final Chromium matrix: 70 passed across dev/prod/backend paths and embedding, including idle renewal, failed exchange recovery, cancellation, and six production/development restart configurations.
  • Isolated real Redis transport/context/upload suite: 390 passed.
  • Real Granian plus database import-order regressions: 15 passed.
  • All 13 frontend runtime/lifecycle wrappers pass, including cookie-replacement readiness and teardown regressions.
  • Ruff check/format and pyright reflex tests pass. Minimum-dependency checks pass for reflex, reflex-base, and reflex-components-core. Stub generation makes no tracked changes.
  • Full local pre-commit has six existing macOS-only Pyright errors in unchanged reflex-bench/reflex-workflow CPU-affinity code. All other hooks pass; CI pre-commit passes on Linux.
  • The advisory playground-0.8.23 job fails on that older release's missing greenlet dependency. Current-head playground and size checks pass. Large CI matrices are still running after the final pushes; cancelled duplicate runs also temporarily report failed gate checks.

All substantive feedback is addressed. Review-thread replies explain the intentional connection-lifetime authority policy and declined hypothetical/style-only requests. Final adversarial review found no additional code blockers.

Related to ENG-12920, ENG-12921, ENG-9088.