feat: add sliding session timeout with idle and absolute caps

gatehouse_app/models/user/session.py

@@ -1,5 +1,6 @@
 """Session model."""
 from datetime import datetime, timedelta, timezone
+from flask import current_app
 from gatehouse_app.extensions import db
 from gatehouse_app.models.base import BaseModel
 from gatehouse_app.utils.constants import SessionStatus
@@ -38,33 +39,71 @@ class Session(BaseModel):
         return f"<Session user_id={self.user_id} status={self.status}>"
 
     def is_active(self):
-        """Check if session is currently active."""
+        """Check if session is currently active.
+
+        Sessions are evaluated against two independent timeouts:
+        - Idle timeout: expires if no request has been made within
+          SESSION_IDLE_TIMEOUT seconds (default 15 min).
+        - Absolute timeout: expires if SESSION_ABSOLUTE_TIMEOUT seconds
+          have elapsed since the session was created (default 8 h),
+          regardless of activity.
+
+        A session must satisfy *both* constraints to remain active.
+        """
         now = datetime.now(timezone.utc)
-        expires_at = self.expires_at
-        if expires_at.tzinfo is None:
-            expires_at = expires_at.replace(tzinfo=timezone.utc)
+        created_at = self.created_at
+        last_activity_at = self.last_activity_at
+
+        if created_at.tzinfo is None:
+            created_at = created_at.replace(tzinfo=timezone.utc)
+        if last_activity_at.tzinfo is None:
+            last_activity_at = last_activity_at.replace(tzinfo=timezone.utc)
+
+        idle_timeout = current_app.config.get("SESSION_IDLE_TIMEOUT", 900)
+        absolute_timeout = current_app.config.get("SESSION_ABSOLUTE_TIMEOUT", 28800)
+
+        idle_expires_at = last_activity_at + timedelta(seconds=idle_timeout)
+        absolute_expires_at = created_at + timedelta(seconds=absolute_timeout)
+
         return (
             self.status == SessionStatus.ACTIVE
-            and expires_at > now
+            and now < idle_expires_at
+            and now < absolute_expires_at
             and self.deleted_at is None
         )
 
     def is_expired(self):
-        """Check if session has expired."""
-        now = datetime.now(timezone.utc)
-        expires_at = self.expires_at
-        if expires_at.tzinfo is None:
-            expires_at = expires_at.replace(tzinfo=timezone.utc)
-        return now > expires_at
+        """Check if session has expired (either idle or absolute)."""
+        return not self.is_active() and self.status != SessionStatus.REVOKED
 
-    def refresh(self, duration_seconds: int = 86400):
-        """Refresh session expiration.
+    def refresh(self, duration_seconds: int = None):
+        """Extend the session expiration using a sliding window.
+
+        The new ``expires_at`` is set to *now + idle timeout*, but is
+        capped so that the session never exceeds the absolute lifetime
+        (``created_at + absolute timeout``).
 
         Args:
-            duration_seconds: New session duration in seconds
+            duration_seconds: Override for the idle timeout.  When *None*
+                (the common case), the value is read from
+                ``SESSION_IDLE_TIMEOUT`` in the Flask config.
         """
-        self.expires_at = datetime.now(timezone.utc) + timedelta(seconds=duration_seconds)
-        self.last_activity_at = datetime.now(timezone.utc)
+        now = datetime.now(timezone.utc)
+
+        if duration_seconds is None:
+            duration_seconds = current_app.config.get("SESSION_IDLE_TIMEOUT", 900)
+
+        absolute_timeout = current_app.config.get("SESSION_ABSOLUTE_TIMEOUT", 28800)
+
+        idle_expires_at = now + timedelta(seconds=duration_seconds)
+
+        created_at = self.created_at
+        if created_at.tzinfo is None:
+            created_at = created_at.replace(tzinfo=timezone.utc)
+        absolute_expires_at = created_at + timedelta(seconds=absolute_timeout)
+
+        self.expires_at = min(idle_expires_at, absolute_expires_at)
+        self.last_activity_at = now
         db.session.commit()
 
     def revoke(self, reason: str = None):