fix(security): P2 dashboard batch + P1-8 dead-code retraction (#50)

* fix(security): use constant-time compare for CSRF token verification

ValidateCSRFToken compared the request-supplied token against the
session-bound token with `!=`, which is byte-by-byte and exits on the
first mismatch. The values are both 256-bit cryptographically random
strings, so the practical exposure on a non-pathological network was
low — but every other secret comparison in the codebase (the agent's
API key, webhook HMAC) uses crypto/subtle.ConstantTimeCompare. CSRF
should match.

P2-1 from the 2026-05 security audit.

* fix(security): add hard TTL on top of sliding session timeout

The session expiration check used a single sliding-window timeout that
ExtendSession refreshed on every request. A heavily-used account
(notably admins with the dashboard open in a long-lived browser tab)
could effectively never re-authenticate — a stolen session cookie was
useful indefinitely.

Adds a configurable absolute hard TTL alongside the existing sliding
window. The new sessionStartKey ("session_start") is set ONCE at login
and never touched by ExtendSession. GetUser now checks both:

  1. Sliding idle timeout (existing behavior, sessionLoginKey).
  2. Absolute hard TTL (new, sessionStartKey + absoluteTimeout).

Configuration:
- SESSION_ABSOLUTE_HOURS env var (defaults to 24h).
- 0 disables the hard TTL — keeps the legacy sliding-only behavior
  for deployments that want it.
- absoluteTimeout < timeout is rejected at NewManager time (would mean
  the hard TTL fires before the sliding window ever could; almost
  certainly a config error).

The cookie's MaxAge now uses the larger of (sliding, absolute) so the
browser drops the cookie no later than the server-side max — even if a
later bug skipped server-side expiry.

Older sessions that predate this commit don't carry sessionStartKey.
GetUser treats those as if they just started (falls back to
sessionLoginKey) — they hit the hard TTL one window later than fresh
sessions, but the alternative is logging existing users out at deploy
time.

P2-3 from the 2026-05 security audit.

* fix(security): emit Strict-Transport-Security + Permissions-Policy headers

Two security-relevant headers were missing from the response from the
SecurityHeaders middleware:

- Strict-Transport-Security: tells the browser to never speak plain
  HTTP to this origin again for the next year (and to apply that to
  subdomains, and to be eligible for the HSTS preload list). Without
  it, a MITM-positioned attacker can force a downgrade on the very
  first visit after a TLS-cert-rotation reload, or after the user
  clicks an http:// link to the dashboard. The header is only honored
  over HTTPS, so emitting unconditionally is safe for dev :3000.

- Permissions-Policy: explicitly disables camera, microphone, geolocation,
  USB, payment, and a few Chrome-specific tracking surfaces (interest-
  cohort, browsing-topics). None of these are used anywhere in the
  dashboard — so a future XSS or iframe-embedded asset can't silently
  ask the browser to enable them without a corresponding source change
  to this middleware.

Both headers are best-practice defenses that pair with the existing
CSP / X-Frame-Options / Referrer-Policy stack; cost is zero bytes of
extra logic and a couple hundred bytes per response.

Tests verify presence + the key tokens (max-age, includeSubDomains,
preload for HSTS; geolocation, microphone, camera, usb, payment for
Permissions-Policy).

P2-6 from the 2026-05 security audit.

* chore(security): remove dead Alpine.js dialog components (P1-8 retraction)

components/dialog.templ declared three Alpine.js-based templates
(Dialog, ConfirmDialog, AlertDialog) that used x-data / x-show /
@click.away / @keydown.escape.window directives. The 2026-05 audit
flagged this as broken on the assumption that Alpine wasn't loaded
anywhere in the base layout — and the audit was correct about Alpine
not being loaded, but WRONG about the implication.

Closer reading: zero callers anywhere in the repo reference
components.Dialog / components.ConfirmDialog / components.AlertDialog.
The real modal infrastructure is two separate vanilla-JS systems:

  - framework/templates/layouts/base.templ:917+ — ConfirmDialog(),
    PromptDialog(), AlertDialog() templates wired to vanilla
    showConfirmDialog() / showPromptDialog() / showAlertDialog()
    functions. This is what every gear page actually calls.
  - framework/ui/modal.templ — Modal(id, title, size) + ConfirmModal
    for custom-content modals (notes-modal, delete-modal, etc.),
    also vanilla JS via closeModal(id).

So components/dialog.templ is dead code: never invoked, but a latent
trap because someone reading it might assume Alpine is in play, add it
to base.templ, and break the CSP without realizing the file they were
"making work" was never used.

Drop the .templ source. The local _templ.go build artifact is
already gitignored.

Retracts the P1-8 misframing in docs/security-review/2026-05-findings.md
(the doc still lives on PR #40; will be updated to reflect this
deletion in a follow-up commit there).

* fix(security): close hard-TTL gaps in legacy sessions + cookie MaxAge

Copilot review on PR #50 caught two real holes in the initial P2-3
implementation (a25795c):

1. **Legacy sessions never anchored.** GetUser's fallback for sessions
   that pre-date sessionStartKey compared against sessionLoginKey —
   which ExtendSession refreshes on every request. So a legacy session
   that stayed warm via keepalive would slide indefinitely and never
   hit the absolute hard TTL. The whole point of the hard TTL.

2. **Cookie MaxAge re-sliding.** NewManager set the store-wide cookie
   MaxAge to the absolute timeout, but every Save (including
   ExtendSession's keepalive) re-emitted Set-Cookie with that same
   absolute value measured from "now" — so the browser's cookie expiry
   slid forward forever, not anchored to the session's original login.

Fixes both in ExtendSession:

- (1) When sessionStartKey is absent, capture the CURRENT
  sessionLoginKey as the anchor BEFORE overwriting it. Idempotent for
  already-anchored sessions. Legacy sessions get one full
  absoluteTimeout window from the next post-deploy ExtendSession call,
  then re-authenticate like everyone else.

- (2) Per-save, override session.Options.MaxAge to
  min(sliding-timeout, remaining-absolute-TTL). Uses a copied Options
  struct so the override doesn't bleed into other sessions sharing the
  store. NewManager's store-wide MaxAge simplifies to the sliding
  timeout (which is what login gets when the absolute window is full).

ExtendSession now also refuses to extend a session that's already past
the absolute deadline, returning an explicit error — caller path then
fails on the next GetUser, forcing re-auth.

Two new tests:
- TestManager_ExtendSession_AnchorsLegacySession: strip sessionStartKey
  from a real cookie, call ExtendSession, assert sessionStartKey is set
  in the result.
- TestManager_ExtendSession_CookieMaxAgeShrinks: rewind sessionStartKey
  to 30m ago with 1h sliding + 1h absolute, call ExtendSession, assert
  the Set-Cookie MaxAge is ~1800 (remaining absolute) not 3600 (sliding).

Refs: #50

Author: sarg3nt

gearbox/cmd/server/main.go

@@ -150,15 +150,21 @@ func main() {
 		}
 	}
 
-	// Calculate session timeout
+	// Calculate session timeouts. The sliding window is refreshed on every
+	// request; the absolute window is set ONCE at login and forces re-auth
+	// once exceeded. See 2026-05 audit P2-3.
 	sessionTimeout := time.Duration(cfg.SessionTimeoutMinutes) * time.Minute
+	absoluteSessionTimeout := time.Duration(cfg.SessionAbsoluteHours) * time.Hour
 
 	// Initialize authentication manager with database
-	authManager, err := auth.NewManager(db, cfg.SessionSecret, sessionTimeout, logger)
+	authManager, err := auth.NewManager(db, cfg.SessionSecret, sessionTimeout, absoluteSessionTimeout, logger)
 	if err != nil {
 		log.Fatalf("Failed to create authentication manager: %v", err)
 	}
-	logger.Info("authentication manager initialized")
+	logger.Info("authentication manager initialized",
+		"sliding_timeout", sessionTimeout,
+		"absolute_timeout", absoluteSessionTimeout,
+	)
 
 	// Secure cookies are enabled by default; disable only when TLS is not configured
 	if cfg.TLSCertPath == "" || cfg.TLSKeyPath == "" {

gearbox/internal/framework/auth/auth.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"crypto/rand"
+	"crypto/subtle"
 	"encoding/base64"
 	"fmt"
 	"log/slog"
@@ -18,6 +19,10 @@ const (
 	sessionUserIDKey   = "user_id"
 	sessionTokenKey    = "session_token" // OWASP 2026: Server-side session validation
 	sessionLoginKey    = "login_time"
+	// sessionStartKey is the absolute session start timestamp. Set ONCE at
+	// login and never touched by ExtendSession, so a heavily-used session
+	// can still hit the hard TTL. See 2026-05 audit P2-3.
+	sessionStartKey    = "session_start"
 	csrfTokenKey       = "csrf_token"
 	MaxFailedAttempts  = 5
 	LockoutDuration    = 15 * time.Minute
@@ -27,17 +32,30 @@ const (
 type Manager struct {
 	db           *database.DB
 	sessionStore *sessions.CookieStore
-	timeout      time.Duration
-	logger       *slog.Logger
+	timeout      time.Duration // sliding idle timeout (extended on activity)
+	// absoluteTimeout is the hard upper bound on a session's lifetime,
+	// measured from the original login (not extended on activity). A zero
+	// value disables the hard TTL — only the sliding window applies. See
+	// 2026-05 audit P2-3.
+	absoluteTimeout time.Duration
+	logger          *slog.Logger
 }
 
 // NewManager creates a new authentication manager.
-func NewManager(db *database.DB, sessionSecret string, timeout time.Duration, logger *slog.Logger) (*Manager, error) {
+// absoluteTimeout=0 disables the hard TTL.
+func NewManager(db *database.DB, sessionSecret string, timeout, absoluteTimeout time.Duration, logger *slog.Logger) (*Manager, error) {
 	if len(sessionSecret) < 32 {
 		return nil, fmt.Errorf("session secret must be at least 32 characters")
 	}
+	if absoluteTimeout > 0 && absoluteTimeout < timeout {
+		return nil, fmt.Errorf("absoluteTimeout (%s) must be >= sliding timeout (%s)", absoluteTimeout, timeout)
+	}
 
-	// Create cookie store
+	// Create cookie store. The store-wide MaxAge is the sliding timeout —
+	// this is the value used at Login when the session is fresh and the
+	// hard TTL has its full window remaining. ExtendSession overrides
+	// MaxAge per-save to min(sliding, remaining-absolute) so the browser
+	// also drops the cookie at the hard TTL boundary as it approaches.
 	store := sessions.NewCookieStore([]byte(sessionSecret))
 	store.Options = &sessions.Options{
 		Path:     "/",
@@ -48,10 +66,11 @@ func NewManager(db *database.DB, sessionSecret string, timeout time.Duration, lo
 	}
 
 	return &Manager{
-		db:           db,
-		sessionStore: store,
-		timeout:      timeout,
-		logger:       logger,
+		db:              db,
+		sessionStore:    store,
+		timeout:         timeout,
+		absoluteTimeout: absoluteTimeout,
+		logger:          logger,
 	}, nil
 }
 
@@ -131,10 +150,16 @@ func (m *Manager) Login(w http.ResponseWriter, r *http.Request, email, password
 		return nil, fmt.Errorf("failed to generate CSRF token: %w", err)
 	}
 
-	// Store user ID and session token in cookie
+	// Store user ID and session token in cookie. sessionLoginKey is the
+	// sliding-window timestamp that ExtendSession refreshes on each
+	// request; sessionStartKey is the absolute-start timestamp that is
+	// NEVER refreshed, so a long-active session still hits the hard TTL
+	// (2026-05 audit P2-3).
+	now := time.Now().Unix()
 	session.Values[sessionUserIDKey] = user.ID
 	session.Values[sessionTokenKey] = sessionToken // CRITICAL: Validated on every request
-	session.Values[sessionLoginKey] = time.Now().Unix()
+	session.Values[sessionLoginKey] = now
+	session.Values[sessionStartKey] = now
 	session.Values[csrfTokenKey] = csrfToken
 
 	// Save session
@@ -200,17 +225,35 @@ func (m *Manager) GetUser(r *http.Request) (*models.User, error) {
 		return nil, fmt.Errorf("invalid session: missing token")
 	}
 
-	// Check if session has expired (time-based)
+	// Check sliding idle timeout: time since the most recent extend or login.
 	loginTime, ok := session.Values[sessionLoginKey].(int64)
 	if !ok {
 		return nil, fmt.Errorf("invalid session")
 	}
-
 	if time.Since(time.Unix(loginTime, 0)) > m.timeout {
-		m.logger.Debug("session expired", "user_id", userID)
+		m.logger.Debug("session expired (idle timeout)", "user_id", userID)
 		return nil, fmt.Errorf("session expired")
 	}
 
+	// Check absolute hard TTL: time since the original login. Independent of
+	// activity, so a heavily-used session still has to re-auth once it hits
+	// this cap. Zero disables this check (legacy sliding-only behavior).
+	// See 2026-05 audit P2-3.
+	if m.absoluteTimeout > 0 {
+		startUnix, ok := session.Values[sessionStartKey].(int64)
+		if !ok {
+			// Older sessions written before this field existed don't have
+			// sessionStartKey. Treat them as if they just started — they'll
+			// hit the hard TTL one window later than fresh sessions, but
+			// the alternative is logging existing users out at deploy time.
+			startUnix = loginTime
+		}
+		if time.Since(time.Unix(startUnix, 0)) > m.absoluteTimeout {
+			m.logger.Debug("session expired (absolute timeout)", "user_id", userID)
+			return nil, fmt.Errorf("session expired")
+		}
+	}
+
 	// Get user from database
 	user, err := m.db.GetUserByID(userID)
 	if err != nil {
@@ -278,7 +321,13 @@ func (m *Manager) ValidateCSRFToken(r *http.Request) error {
 		return fmt.Errorf("no CSRF token in request")
 	}
 
-	if requestToken != sessionToken {
+	// Constant-time compare so that a network observer can't recover the
+	// session-bound CSRF token byte by byte from response-timing variance.
+	// The values are both 256-bit randoms generated via crypto/rand, so the
+	// practical risk on a non-pathological network was always low — but
+	// every other secret comparison in this codebase uses subtle, and CSRF
+	// should match (2026-05 audit P2-1).
+	if subtle.ConstantTimeCompare([]byte(requestToken), []byte(sessionToken)) != 1 {
 		return fmt.Errorf("CSRF token mismatch")
 	}
 
@@ -292,6 +341,27 @@ func (m *Manager) IsAuthenticated(r *http.Request) bool {
 }
 
 // ExtendSession refreshes the session login time to prevent timeout.
+//
+// Two extra behaviors on top of the simple "bump sessionLoginKey" path,
+// both addressing follow-up review on the 2026-05 audit P2-3 fix:
+//
+//  1. **Anchor legacy sessions.** If a session predates this commit it
+//     won't have sessionStartKey set. Without anchoring, GetUser's fallback
+//     would compare against the freshly-refreshed sessionLoginKey forever
+//     and the absolute hard TTL would never fire. We capture the CURRENT
+//     (pre-refresh) sessionLoginKey as the anchor, giving the legacy
+//     session one full absoluteTimeout window from now — then it
+//     re-authenticates like everyone else.
+//
+//  2. **Shrink the cookie MaxAge as the hard TTL approaches.** Every Save
+//     re-emits the Set-Cookie header. If we kept the store's default
+//     MaxAge, the browser would see "this cookie is good for sliding-
+//     timeout from right now" on every request, and the cookie would
+//     never reflect the server-side hard TTL. Per-save we set the cookie
+//     MaxAge to min(sliding-timeout, remaining-absolute-TTL) so the
+//     browser ALSO drops the cookie at the absolute boundary. The
+//     override goes on a copied Options struct so we don't mutate the
+//     shared store-wide options.
 func (m *Manager) ExtendSession(w http.ResponseWriter, r *http.Request) error {
 	session, err := m.sessionStore.Get(r, sessionName)
 	if err != nil {
@@ -304,7 +374,39 @@ func (m *Manager) ExtendSession(w http.ResponseWriter, r *http.Request) error {
 		return fmt.Errorf("not authenticated")
 	}
 
-	// Update login time to now
+	// (1) Anchor legacy sessions. Set sessionStartKey to the CURRENT
+	// sessionLoginKey before we overwrite it below. Idempotent for
+	// already-anchored sessions (we only set it when absent).
+	if _, anchored := session.Values[sessionStartKey].(int64); !anchored {
+		if loginTime, ok := session.Values[sessionLoginKey].(int64); ok {
+			session.Values[sessionStartKey] = loginTime
+		}
+	}
+
+	// (2) Override per-save MaxAge to track the hard TTL. Default is the
+	// sliding timeout; if we're inside the absolute TTL window, use
+	// whichever is smaller.
+	if m.absoluteTimeout > 0 {
+		if startUnix, ok := session.Values[sessionStartKey].(int64); ok {
+			remaining := time.Until(time.Unix(startUnix, 0).Add(m.absoluteTimeout))
+			if remaining <= 0 {
+				// Past the hard TTL — don't extend. Caller path will fail
+				// on the next GetUser and force re-auth.
+				return fmt.Errorf("session past absolute timeout")
+			}
+			maxAge := m.timeout
+			if remaining < maxAge {
+				maxAge = remaining
+			}
+			// Copy Options so we don't mutate the shared store struct
+			// (which is the cookie-default applied to every other session).
+			opts := *m.sessionStore.Options
+			opts.MaxAge = int(maxAge.Seconds())
+			session.Options = &opts
+		}
+	}
+
+	// Update login time to now (slides the idle window forward).
 	session.Values[sessionLoginKey] = time.Now().Unix()
 
 	return session.Save(r, w)
@@ -561,10 +663,16 @@ func (m *Manager) CreateSessionForUser(w http.ResponseWriter, r *http.Request, u
 		return fmt.Errorf("failed to generate CSRF token: %w", err)
 	}
 
-	// Store user ID and session token in cookie
+	// Store user ID and session token in cookie. sessionLoginKey is the
+	// sliding-window timestamp that ExtendSession refreshes on each
+	// request; sessionStartKey is the absolute-start timestamp that is
+	// NEVER refreshed, so a long-active session still hits the hard TTL
+	// (2026-05 audit P2-3).
+	now := time.Now().Unix()
 	session.Values[sessionUserIDKey] = user.ID
 	session.Values[sessionTokenKey] = sessionToken // CRITICAL: Validated on every request
-	session.Values[sessionLoginKey] = time.Now().Unix()
+	session.Values[sessionLoginKey] = now
+	session.Values[sessionStartKey] = now
 	session.Values[csrfTokenKey] = csrfToken
 
 	// Save session