Sep 15 - Fixed login session when check 'Remember for 30 days' box

app.py

@@ -12,7 +12,7 @@ so that url_for() resolution is identical to the original monolithic app.py.
 """
 
 from flask import Flask, render_template, request, redirect, url_for, flash, session, g
-from datetime import datetime, timedelta
+from datetime import datetime
 from dotenv import load_dotenv
 import os
 import time as _time
@@ -229,15 +229,28 @@ def create_app() -> Flask:
     @app.before_request
     def adjust_session_lifetime():
         """
-        Dynamically set session lifetime based on the 'remember_me' flag stored
-        in the session.  When the user chose 'Remember Me' at login, their
-        permanent session lives for 30 days; otherwise the default 10-hour
-        lifetime from Config.PERMANENT_SESSION_LIFETIME applies.
+        Enforce the session lifetime chosen at login.
+
+        app.permanent_session_lifetime is deliberately NOT changed here. It is
+        shared by every request in the worker, and Flask checks the session
+        cookie's age against it in open_session() BEFORE this hook runs. Setting
+        it to 10 hours on requests without Remember Me (QR check-ins, the login
+        page) made any Remember Me cookie unused for 10 hours fail to load, and
+        under gevent a concurrent request could also stamp a 10-hour expiry on
+        a Remember Me cookie. It stays at Config.PERMANENT_SESSION_LIFETIME.
+
+        - Remember Me: permanent cookie, 30 days, renewed on every request.
+        - Otherwise: browser-session cookie, and the login ends 10 hours after
+          sign-in (session['login_epoch'], set in auth.login).
         """
-        if session.get('remember_me'):
-            app.permanent_session_lifetime = timedelta(days=30)
-        else:
-            app.permanent_session_lifetime = timedelta(hours=10)
+        if 'user_id' not in session or session.get('remember_me'):
+            return
+        login_epoch = session.get('login_epoch')
+        if login_epoch is None:
+            # Logged in before login_epoch existed: start the 10 hours now
+            session['login_epoch'] = _time.time()
+        elif _time.time() - login_epoch > 10 * 3600:
+            session.clear()
 
     @app.before_request
     def log_request_info():