Jun 28 Optimize code

control/panel/__init__.py

@@ -20,13 +20,17 @@ Env vars required (same /etc/jqc/control.env sourced by the main app):
 
 import os
 import logging
+from datetime import timedelta
 from logging.handlers import RotatingFileHandler
 
 from flask import Flask
+from flask_wtf.csrf import CSRFProtect
 
 from .auth import bp as auth_bp
 from .tenants import bp as tenants_bp
 
+csrf = CSRFProtect()
+
 
 def create_panel_app():
     app = Flask(__name__, template_folder='templates')
@@ -39,6 +43,20 @@ def create_panel_app():
         )
     app.secret_key = secret
 
+    # ── Session lifetime ──────────────────────────────────────────────────
+    # Superadmin sessions expire after 4 hours of inactivity.
+    # Flask default when permanent=True is 31 days — too long for privileged access.
+    app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(hours=4)
+
+    # ── CSRF protection ───────────────────────────────────────────────────
+    # Protects all POST routes in the panel against cross-site request forgery.
+    # Templates include: <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+    csrf.init_app(app)
+
+    # Make csrf_token() available in all panel templates
+    from flask_wtf.csrf import generate_csrf
+    app.jinja_env.globals['csrf_token'] = generate_csrf
+
     # ── Logging ──────────────────────────────────────────────────────────
     log_level = logging.INFO
     formatter = logging.Formatter(