Make auth/admin apps API calls use apiFetch, a new function that asks for permission by iframe if needed. Implement max-age checks for API authz.verify as well along with a custom exception type that carries metadata.

passkey/util/sessionutil.py

@@ -2,19 +2,22 @@
 
 from datetime import datetime, timezone
 
-from ..db import Session
+from ..db import SessionContext
 from .timeutil import parse_duration
 
 
-def check_session_age(session: Session, max_age: str | None) -> bool:
+def check_session_age(ctx: SessionContext, max_age: str | None) -> bool:
     """Check if a session satisfies the max_age requirement.
 
+    Uses the credential's last_used timestamp to determine authentication age,
+    since session renewal can happen without re-authentication.
+
     Args:
-        session: The session record to check
+        ctx: The session context containing session and credential info
         max_age: Maximum age string (e.g., "5m", "1h", "30s") or None
 
     Returns:
-        True if session is recent enough or max_age is None, False if too old
+        True if authentication is recent enough or max_age is None, False if too old
 
     Raises:
         ValueError: If max_age format is invalid
@@ -23,5 +26,12 @@ def check_session_age(session: Session, max_age: str | None) -> bool:
         return True
 
     max_age_delta = parse_duration(max_age)
-    time_since_auth = datetime.now(timezone.utc) - session.renewed
+
+    # Use credential's last_used time if available, fall back to session renewed
+    if ctx.credential and ctx.credential.last_used:
+        auth_time = ctx.credential.last_used
+    else:
+        auth_time = ctx.session.renewed
+
+    time_since_auth = datetime.now(timezone.utc) - auth_time
     return time_since_auth <= max_age_delta