feat(session_store): can logout session after n seconds

Author: kennethrioja

config/initializers/session_store.rb

@@ -1,3 +1,10 @@
 # Be sure to restart your server when you modify this file.
-opts = Rails.env.production? ? { same_site: :lax, secure: true } : {}
+opts = {}
+
+if Rails.env.production?
+  opts = { same_site: :lax, secure: true }
+  expiry_time = TeSS::Config.login_expires_after
+  opts[:expire_after] = expiry_time unless expiry_time.nil?
+end
+
 Rails.application.config.session_store :cookie_store, **opts

config/tess.example.yml

@@ -13,6 +13,7 @@ default: &default
   announcement_message:
   prevent_robot_indexing: false
   require_cookie_consent: true
+  login_expires_after: # in seconds, sets the login session duration, after this, users must login again, leave blank to disable.
   blocked_domains:
     - !ruby/regexp '/bad-domain\.example/'
   blocked_countries: # Block registration from the following ISO 3166-1 alpha-2 codes

test/integration/session_expiry_test.rb

@@ -0,0 +1,21 @@
+require 'test_helper'
+
+class SessionExpiryTest < ActionDispatch::IntegrationTest
+  test 'sets expire_after in production' do
+    Rails.stub(:env, ActiveSupport::StringInquirer.new('production')) do
+      TeSS::Config.stub(:login_expires_after, 3600) do
+        load Rails.root.join('config/initializers/session_store.rb')
+        assert_equal 3600, Rails.application.config.session_options[:expire_after]
+      end
+    end
+  end
+
+  test 'does not set expire_after outside production' do
+    Rails.stub(:env, ActiveSupport::StringInquirer.new('test')) do
+      TeSS::Config.stub(:login_expires_after, 3600) do
+        load Rails.root.join('config/initializers/session_store.rb')
+        assert_nil Rails.application.config.session_options[:expire_after]
+      end
+    end
+  end
+end