feat(be): record that a session is still in use

[sea-snake]

Design: #4224. Overview: #4230.

"This browser used this app 3 minutes ago" against "5 weeks ago" is what makes a session list worth reading, and what lets someone spot a session they do not recognise still being used rather than merely still existing.

Every refresh stamps, and three consumers make coarsening it unattractive: the session cap orders live sessions on this field, so inside a coarsening interval every session would look equally idle; the browser registry cap orders on the same signal, where an hour is long enough to drop a browser in use; and a user-facing list that can be an hour stale does not answer the question it exists to answer. The write is small next to what the call already does, which inserts a canister signature and calls update_root_hash().

The same write carries three stamps:

Field	Lives on	Drives
last_used	the account reference	account eviction (#4235)
last_refreshed	the session record	the session cap (#4267) and the user-facing list
last_used	the device record	the registry cap (#4242) and the settings list

Stamping the device is the only reason refresh touches the anchor: it authenticates by session chain and never runs check_authorization. What that write buys is a use signal a sign-in stamp cannot give the browser list.

Stable writes scale with 1/T alongside the calls, so lowering the app-delegation TTL multiplies both.

Tests: session_refresh_stamp_tests (7), including a stamp for a session that is gone writing nothing, and a refresh advancing the device's last_used while leaving its enrolment timestamp alone. PocketIC drives two refreshes a minute apart and reads the device back off identity_info.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 3cd69a2.

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=32dd7f87-bb8b-47eb-9978-83f0bbd505ef&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type

Relevant files

Enhancement

► src/internet_identity/src/sessions.rs     Modify app_prepare_delegation to return locator and stamp session refresh ► src/internet_identity/src/storage.rs     Add stamp_session_refresh and related logic ► src/internet_identity/src/storage/anchor.rs     Add stamp_session_device_use method ► src/internet_identity/src/storage/tests.rs     Add tests for session refresh stamping behavior ► src/internet_identity/tests/integration/sessions.rs     Add integration tests to verify stamping on refresh

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.