Vibescript Showcase

Session expiry

Set a session expiry time from its risk level.

Showcase

Edit the source, then Run. Checks start after your first Run. Ctrl/⌘ + Enter runs; Tab indents. Preview services use sample data and never contact a real service.

Sourceshowcase/security/session_expiry.vibe
type Session_SnapshotResult = {
  age: string,
  expires_at: string,
  refreshable: bool,
  risk: string,
  ttl: string,
  user_id: string
}

type RunResult = { sensitive: Session_SnapshotResult, trusted: Session_SnapshotResult }

enum SessionRisk
  Trusted
  Standard
  Sensitive
end

def ttl_for(risk: SessionRisk) -> duration
  if risk == SessionRisk::Trusted
    30.days
  elsif risk == SessionRisk::Standard
    12.hours
  else
    30.minutes
  end
end

def refresh_window(risk: SessionRisk) -> duration
  if risk == SessionRisk::Sensitive
    10.minutes
  else
    2.hours
  end
end

def session_snapshot(
  user_id: string,
  risk: SessionRisk,
  issued_at: time,
  now: time
) -> Session_SnapshotResult
  age = Duration.build(seconds: (now - issued_at).to_i)
  ttl = ttl_for(risk)

  {
    user_id: user_id,
    risk: risk.name,
    age: age.iso8601,
    ttl: ttl.iso8601,
    expires_at: ttl.after(issued_at).format("2006-01-02T15:04:05Z"),
    refreshable: age <= refresh_window(risk)
  }
end

def run -> RunResult
  issued_at = Time.at(1700000000)
  now = 90.minutes.after(issued_at)

  {
    trusted: session_snapshot("user_100", SessionRisk::Trusted, issued_at, now),
    sensitive: session_snapshot("user_200", SessionRisk::Sensitive, issued_at, now)
  }
end

Output

Click Run example to see the result.

Code checks

Run once to load the checker. Your code stays in this browser.