06/03 Optimize app

app/__init__.py

@@ -120,6 +120,35 @@ def create_app(config_name=None):
         from app.models.teller_enrollment import TellerEnrollment, TellerAccount
         from app.models.schwab_connection import SchwabConnection, SchwabAccount
 
+    # ── Session idle timeout ──────────────────────────────────────────────────
+    from flask import session as _session, request as _request
+    from flask_login import current_user as _cu
+    from datetime import timedelta, datetime as _dt
+    import logging as _logging
+    _log = _logging.getLogger('app.auth')
+    SESSION_IDLE_MINUTES = app.config.get('SESSION_IDLE_MINUTES', 60)
+
+    @app.before_request
+    def check_session_timeout():
+        # Skip static files and unauthenticated sessions
+        if _request.endpoint and _request.endpoint.startswith('static'):
+            return
+        if not _cu.is_authenticated:
+            return
+        last = _session.get('_last_active')
+        now  = _dt.utcnow().isoformat()
+        if last:
+            idle = (_dt.utcnow() - _dt.fromisoformat(last)).total_seconds() / 60
+            if idle > SESSION_IDLE_MINUTES:
+                from flask_login import logout_user as _lu
+                _lu()
+                _session.clear()
+                from flask import redirect, url_for, flash
+                _log.info('[auth] session expired after %.0f min idle', idle)
+                flash('Your session expired due to inactivity. Please log in again.', 'warning')
+                return redirect(url_for('auth.login'))
+        _session['_last_active'] = now
+
     @app.after_request
     def security_headers(response):
         response.headers['X-Frame-Options'] = 'DENY'