luci-base: mark background poll XHRs with X-Ubus-No-Touch header

LuCI polls rpcd every few seconds to refresh the page and check
session status.  These background XHRs inadvertently reset the rpcd
session idle timer, so 'option sessiontime' in /etc/config/rpcd has
no effect in practice — the session never expires while a LuCI tab
is open, even if the user is not actively using it.

Fix this by setting an X-Ubus-No-Touch: 1 request header on XHRs that
are not driven by a user gesture, so the server side can opt out of
refreshing the idle timer for them.

Capture-phase document listeners for common user interaction event types
record a timestamp (Request.lastUserInteraction) on every gesture.
Request.request() computes opt.background synchronously — before the
Promise.resolve() deferral — by comparing that timestamp against a
BACKGROUND_THRESHOLD (5 s).  This survives async continuations: RPCs
issued from .then() chains after an intervening network round-trip or
modal confirmation (e.g. ui.changes.apply, uci.save) are treated as
foreground for as long as the user's last gesture is recent.

For the batched ubus path flushRequestQueue() sets X-Ubus-No-Touch only
when every entry in the batch carries opt.background, so a foreground
RPC sharing a batch with a background poll still touches the session.

Companion patches:
  rpcd:   honour notouch in session/access
  uhttpd: parse X-Ubus-No-Touch and forward notouch to rpcd

Signed-off-by: Michael Pfeifroth <micpf@westermo.com>

Author: micpf

modules/luci-base/htdocs/luci-static/resources/luci.js

@@ -514,6 +514,14 @@
 
 	const requestQueue = [];
 
+	/* Requests made within BACKGROUND_THRESHOLD ms of a user gesture are
+	 * foreground (session-touching); all others are background.
+	 */
+	const BACKGROUND_THRESHOLD = 5000;
+	for (const type of ['click', 'submit', 'change', 'input', 'keydown', 'mousedown', 'touchstart']) {
+		document.addEventListener(type, () => { Request.lastUserInteraction = Date.now() }, true);
+	}
+
 	/**
 	 * Check whether a Request.options object is eligible to be queued for RPC
 	 * batching.
@@ -570,6 +578,8 @@
 			reqopt.content[i] = batch[i][0].content;
 		}
 
+		reqopt.background = batch.every(e => e[0].background);
+
 		requestQueue.length = 0;
 
 		Request.request(rpcBaseURL, reqopt).then(reply => {
@@ -605,6 +615,8 @@
 
 		interceptors: [],
 
+		lastUserInteraction: 0,
+
 		/**
 		 * Turn the given relative URL into an absolute URL if necessary.
 		 *
@@ -665,6 +677,11 @@
 		 * @property {Object<string, string>} [header]
 		 * Specifies HTTP headers to set for the request.
 		 *
+		 * @property {boolean} [background]
+		 * Whether the request is a background poll that should not reset the
+		 * server-side session idle timer.  Determined automatically from
+		 * recent user interaction; set explicitly to override.
+		 *
 		 * @property {function()} [progress]
 		 * An optional request callback function which receives ProgressEvent
 		 * instances as sole argument during the HTTP request transfer.
@@ -689,6 +706,10 @@
 		 * The resulting HTTP response.
 		 */
 		request(target, options) {
+			const background = ('background' in (options ?? {}))
+				? options.background
+				: (Date.now() - Request.lastUserInteraction) > BACKGROUND_THRESHOLD;
+
 			return Promise.resolve(target).then(url => {
 				const state = { xhr: new XMLHttpRequest(), url: this.expandURL(url), start: Date.now() };
 				const opt = Object.assign({}, options, state);
@@ -698,6 +719,9 @@
 
 				return new Promise((resolveFn, rejectFn) => {
 					opt.xhr.onreadystatechange = callback.bind(opt, resolveFn, rejectFn);
+
+					opt.background = background;
+
 					opt.method = String(opt.method ?? 'GET').toUpperCase();
 
 					if ('query' in opt) {
@@ -787,6 +811,9 @@
 									contenttype = opt.headers[header];
 							}
 
+					if (opt.background)
+						opt.xhr.setRequestHeader('X-Ubus-No-Touch', '1');
+
 					if ('progress' in opt && 'upload' in opt.xhr)
 						opt.xhr.upload.addEventListener('progress', opt.progress);