fix(authflow): evaluate max_age from per-session auth time, not global LastLogin

The max_age check in trySessionLogin compared now against
ui.LastLogin, a single global per-identity row rewritten to now() by
EVERY interactive login from ANY browser, device, or session. A fresh
login on a second device therefore satisfied an RP's max_age
re-authentication demand for a stale session on the first device.

The per-session, per-client authentication timestamp already exists and
is populated (storage.ClientAuthState.AuthenticatedAt, written on
direct login and carried across for SSO). Use it, falling back to
ui.LastLogin only when the session has no client state.

Author: SashaMIT

server/authflow/sessionlogin.go

@@ -62,9 +62,19 @@ func (h *Handler) trySessionLoginWithSession(ctx context.Context, r *http.Reques
 		return false
 	}
 
-	// Check max_age: if the user's last authentication is too old, force re-auth.
+	// Check max_age against THIS session's authentication time for this client,
+	// not the global per-identity LastLogin. ui.LastLogin is a single global row
+	// rewritten to now() by EVERY interactive login from ANY browser/device, so a
+	// fresh login on a second device would otherwise satisfy an RP's max_age
+	// re-authentication demand for a stale session on the first. The per-session,
+	// per-client timestamp already exists (ClientAuthState.AuthenticatedAt,
+	// carried across for SSO above) and is guaranteed non-nil here.
 	if authReq.MaxAge >= 0 {
-		if now.Sub(ui.LastLogin) > time.Duration(authReq.MaxAge)*time.Second {
+		authenticatedAt := ui.LastLogin
+		if cs := session.ClientStates[authReq.ClientID]; cs != nil && !cs.AuthenticatedAt.IsZero() {
+			authenticatedAt = cs.AuthenticatedAt
+		}
+		if now.Sub(authenticatedAt) > time.Duration(authReq.MaxAge)*time.Second {
 			return false
 		}
 	}

server/authflow/sessionlogin_test.go

@@ -662,7 +662,7 @@ func setupSessionWithIdentity(t *testing.T, s *sessionTestServer, now time.Time,
 		ID:          nonce, Secret: nonce,
 		ClientStates: map[string]*storage.ClientAuthState{
 			"client-1": {
-				AuthenticatedAt: now.Add(-1 * time.Minute),
+				AuthenticatedAt: lastLogin,
 				LastActivity:    now.Add(-1 * time.Minute),
 			},
 		},