PR-C — Control Center Sessions Integration

[man4ish]

Summary

Integrates the Session Foundation from omnibioai-auth into the OmniBioAI Control Center.

Sessions are exposed as a self-service feature under:

Security → Sessions

The Control Center remains a relay layer. Session authorization and lifecycle decisions remain owned by omnibioai-auth.

Architecture

Browser
→ control-center-web nginx
→ control-center backend
→ omnibioai-auth

No API Gateway was inserted into this path.

API

• GET /sessions
• GET /sessions/{session_id}
• POST /sessions/{session_id}/revoke

UI

• Added functional Sessions page
• Activated the existing Security → Sessions navigation entry
• Session table with status badges
• Session details modal
• Explicit revoke confirmation dialog
• Loading, empty, error, and expired-session states
• Reuses existing Control Center UI components

A "current session" indicator was intentionally not added because the current Session API/JWT contract does not expose a reliable browser-session correlation identifier.

Security

• Authorization header is relayed unchanged
• Control Center does not forge authentication credentials
• No tokens or cookies are stored by Control Center
• No secrets are logged
• Cross-user session access remains denied by omnibioai-auth
• Unknown/non-owned sessions return 404
• Unauthenticated requests return 401
• Session revocation remains enforced by omnibioai-auth

nginx

The Sessions route uses the existing dynamic Docker DNS upstream:

$control_center_upstream

This preserves the previously implemented Docker DNS re-resolution fix and avoids stale container-IP caching.

Validation

• Frontend: 381 passed
• Backend: 907 passed
• Coverage: 99.14%
• Sessions proxy coverage: 100%
• nginx regression tests: 3/3 passed
• git diff --check: PASS
• Real-stack E2E validation completed

Validated flow:

Browser
→ admin.omnibioai.org
→ control-center-web
→ control-center
→ omnibioai-auth

Verified:

• Login
• List sessions
• Get session details
• Revoke session
• Repeated/idempotent revoke
• Unknown session → 404
• Unauthenticated request → 401
• Cross-user access → 404

Scope

This PR does not modify omnibioai-auth.

This PR does not implement Interactions.

This PR does not introduce a new session store in Control Center.

Review notes

Unrelated concurrent working-tree changes were deliberately excluded from this commit and remain outside this PR.

🤖 Generated with Claude Code