04/28 Updated sprint 4 & 5

config.py

@@ -46,7 +46,7 @@ class Config:
     # ------------------------------------------------------------------ #
     # Session / cookies
     # ------------------------------------------------------------------ #
-    PERMANENT_SESSION_LIFETIME = timedelta(days=30)
+    PERMANENT_SESSION_LIFETIME = timedelta(hours=10)  # Reduced from 30 days — payroll data sensitivity
     SESSION_COOKIE_SECURE = (
         os.environ.get('SESSION_COOKIE_SECURE', 'false').lower() == 'true'
     )
@@ -60,11 +60,6 @@ class Config:
     # ------------------------------------------------------------------ #
     COMPANY_NAME    = os.environ.get('COMPANY_NAME',    'QR Code Management System')
     CONTRACT_NAME   = os.environ.get('CONTRACT_NAME',   'Default Contract')
-    # Public-facing base URL used when constructing QR code destination links.
-    # Set this to your domain with no trailing slash, e.g.:
-    #   QR_BASE_URL=https://qr.govservicesinc.com
-    # This prevents doubled-hostname issues when running behind a reverse proxy.
-    QR_BASE_URL     = os.environ.get('QR_BASE_URL', '').rstrip('/')
 
     # ------------------------------------------------------------------ #
     # File uploads