fix(session-policy): invalidate membership cache on removal/transfer, spare impersonator sessions in revoke-all, raise idle floor to 2x cookie window

Author: waleedlatif1

apps/docs/content/docs/en/platform/enterprise/session-policies.mdx

@@ -29,7 +29,7 @@ Use this to enforce periodic re-authentication — for example, a value of `168`
 
 Signs a member out after this many hours without activity. Activity extends the session, so members who use Sim regularly stay signed in; dormant sessions expire.
 
-Accepts 24 to 8760 hours. The 24-hour minimum exists because session activity is recorded at most once per day — a shorter window would sign out members who are actively working.
+Accepts 48 to 8760 hours. The 48-hour minimum exists because session activity is recorded at most once per day — a shorter window could sign out members who are actively working.
 
 ### Sign out all members
 
@@ -68,9 +68,9 @@ Use this after a security incident, an offboarding wave, or before tightening a
         'No. It revokes browser sign-in sessions only. API keys, deployed workflows, webhooks, and schedules keep working — manage those separately from the API keys settings.',
     },
     {
-      question: 'Why is the minimum idle timeout 24 hours?',
+      question: 'Why is the minimum idle timeout 48 hours?',
       answer:
-        'Session activity is recorded at most once per 24 hours for performance. An idle timeout below that window could sign out members who are actively using Sim, so shorter values are not accepted.',
+        'Session activity is recorded at most once per 24 hours for performance. The minimum is twice that window so a member who stays active always registers activity before the idle limit can expire their session.',
     },
   ]}
 />

apps/sim/app/api/organizations/[id]/sessions/revoke/route.ts

@@ -73,6 +73,11 @@ export const POST = withRouteHandler(
       return NextResponse.json({ error: 'Organization not found' }, { status: 404 })
     }
 
+    // When the caller is a platform admin impersonating an org member, the
+    // current token is the impersonation session — also spare the admin's own
+    // real sessions so ending impersonation doesn't leave them signed out.
+    const impersonatorId =
+      (session.session as { impersonatedBy?: string | null }).impersonatedBy ?? null
     const revoked = await db
       .delete(sessionTable)
       .where(
@@ -85,7 +90,8 @@ export const POST = withRouteHandler(
               .where(eq(member.organizationId, organizationId))
           ),
           isNull(sessionTable.impersonatedBy),
-          ne(sessionTable.token, session.session.token)
+          ne(sessionTable.token, session.session.token),
+          ...(impersonatorId ? [ne(sessionTable.userId, impersonatorId)] : [])
         )
       )
       .returning({ id: sessionTable.id })

apps/sim/lib/api/contracts/organization.ts

@@ -145,12 +145,14 @@ export const organizationDataRetentionResponseSchema = z.object({
 /**
  * Session-policy bounds — the single source for the contract validation, the
  * server-side clamp (`@/lib/auth/session-policy`), and the settings UI.
- * `MIN_IDLE_TIMEOUT_HOURS` matches the session cookie-cache window: activity
- * is only recorded on DB-path refreshes, so a shorter idle timeout would sign
- * out demonstrably active users.
+ * `MIN_IDLE_TIMEOUT_HOURS` is twice the session cookie-cache window (24h):
+ * cached reads never record activity, so a continuously active user only
+ * refreshes their session when the cookie cache expires. A floor of one
+ * window would sign out active users exactly at the cache boundary; two
+ * windows guarantees a DB-path refresh lands before the idle limit can.
  */
 export const MIN_SESSION_LIFETIME_HOURS = 1
-export const MIN_IDLE_TIMEOUT_HOURS = 24
+export const MIN_IDLE_TIMEOUT_HOURS = 48
 export const MAX_SESSION_POLICY_HOURS = 8760
 
 export const updateOrganizationSessionPolicyBodySchema = z.object({
@@ -165,7 +167,7 @@ export const updateOrganizationSessionPolicyBodySchema = z.object({
     .int()
     .min(
       MIN_IDLE_TIMEOUT_HOURS,
-      'Idle timeout must be at least 24 hours — session activity is only recorded once per cookie-cache window'
+      'Idle timeout must be at least 48 hours — session activity is recorded at most once per 24h cookie-cache window'
     )
     .max(MAX_SESSION_POLICY_HOURS, 'Idle timeout cannot exceed 8760 hours (1 year)')
     .nullable(),

apps/sim/lib/billing/organizations/membership.ts

@@ -24,6 +24,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { normalizeEmail } from '@sim/utils/string'
 import { and, count, eq, inArray, isNull, ne, or, sql } from 'drizzle-orm'
+import { invalidateMembershipCache } from '@/lib/auth/security-policy'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
 import {
   assertNoUnresolvedEnterpriseIssuance,
@@ -1343,7 +1344,7 @@ export async function transferUserBetweenOrganizations(
   }
 
   try {
-    return await withInvitationSafeOrganizationAccessMutation(
+    const transferResult = await withInvitationSafeOrganizationAccessMutation(
       {
         userId: params.userId,
         organizationId: params.sourceOrganizationId,
@@ -1513,6 +1514,10 @@ export async function transferUserBetweenOrganizations(
         }
       }
     )
+    // The transferred member's cookie-version/hook-clamp fallbacks must
+    // resolve to the destination org immediately, not after the cache TTL.
+    invalidateMembershipCache(params.userId)
+    return transferResult
   } catch (error) {
     logger.error('Failed to transfer organization member', { ...params, error })
     return { success: false, error: getErrorMessage(error), ...emptyResult }
@@ -1733,6 +1738,10 @@ export async function removeUserFromOrganization(
     billingActions.workspaceAccessRevoked = result.workspaceIdsToRevoke.length
     billingActions.pendingInvitationsCancelled = result.pendingInvitationsCancelled
 
+    // The departed member's cookie-version/hook-clamp fallbacks must stop
+    // resolving to this org immediately, not after the membership-cache TTL.
+    invalidateMembershipCache(userId)
+
     if (result.usageCaptured > 0) {
       logger.info('Captured departed member usage', {
         organizationId,