# Platform-Specific Session Lifetime

## Overview

This feature automatically sets different session lifetimes based on whether the user is accessing the application from the **mobile app** or the **web browser**. This provides a better user experience by:

- **Web users**: Getting logged out after 2 hours of inactivity (for security)
- **Mobile app users**: Staying logged in for 30 days (for convenience)

## How It Works

### 1. Middleware Detection

The `SetPlatformSessionLifetime` middleware runs on every request and detects the platform using multiple methods:

1. **Custom Header**: Checks for `X-Platform: mobile-app` header (most reliable)
2. **User Agent**: Looks for Capacitor-specific strings (e.g., "Capacitor", "WKWebView")
3. **Platform Patterns**: Detects iOS/Android native app patterns

### 2. Session Lifetime Configuration

The middleware sets the session lifetime based on the detected platform:

- **Web**: 120 minutes (2 hours) - configured via `SESSION_LIFETIME_WEB`
- **Mobile App**: 43,200 minutes (30 days) - configured via `SESSION_LIFETIME_MOBILE`

### 3. Configuration Files

#### Environment Variables (`.env`)

```env
# Platform-specific session lifetimes
SESSION_LIFETIME_WEB=120        # 2 hours for web users
SESSION_LIFETIME_MOBILE=43200   # 30 days for mobile app users
```

#### Capacitor Configuration

The mobile app automatically sends a custom header `X-Platform: mobile-app` with every request:

**Production** (`mobile/capacitor.config.json`):
```json
{
  "server": {
    "url": "https://ashlar.club",
    "headers": {
      "X-Platform": "mobile-app"
    }
  }
}
```

**Development** (`mobile/mobile/capacitor.config.json`):
```json
{
  "server": {
    "url": "http://localhost:8082",
    "headers": {
      "X-Platform": "mobile-app"
    }
  }
}
```

## Testing

### Test Web Session (2 hours)

1. Open the application in a web browser
2. Log in
3. Check Laravel logs - should see: `Web session detected`
4. Session will expire after 2 hours of inactivity

### Test Mobile App Session (30 days)

1. Open the mobile app
2. Log in
3. Check Laravel logs - should see: `Mobile app session detected`
4. Session will expire after 30 days of inactivity

### Verify in Logs

```bash
docker compose exec app tail -f storage/logs/laravel.log | grep "session detected"
```

You should see logs like:
```
[2025-10-14 02:00:00] local.INFO: Mobile app session detected {"user_agent":"...","lifetime_minutes":43200,"lifetime_days":30}
[2025-10-14 02:00:01] local.INFO: Web session detected {"user_agent":"...","lifetime_minutes":120,"lifetime_hours":2}
```

## Customization

### Adjust Session Lifetimes

Edit the `.env` file:

```env
# For web users - change to desired minutes
SESSION_LIFETIME_WEB=120

# For mobile app users - change to desired minutes
SESSION_LIFETIME_MOBILE=43200
```

Common values:
- 1 hour: `60`
- 2 hours: `120`
- 1 day: `1440`
- 7 days: `10080`
- 30 days: `43200`
- 90 days: `129600`

### Add More Detection Methods

Edit `app/Http/Middleware/SetPlatformSessionLifetime.php` and add custom detection logic in the `isMobileApp()` method.

## Security Considerations

1. **Web sessions are shorter** (2 hours) to reduce security risks from unattended sessions
2. **Mobile app sessions are longer** (30 days) for better UX, but still require periodic re-authentication
3. **Session cookies are HttpOnly** and use secure settings as configured in `config/session.php`
4. **All sessions expire** eventually - no infinite sessions

## Troubleshooting

### Mobile app not detected

1. Check if the custom header is being sent:
   - Look for `X-Platform: mobile-app` in request headers
2. Verify Capacitor config has the headers section
3. Rebuild the mobile app after changing Capacitor config

### Web users getting long sessions

1. Check middleware is running before `StartSession`
2. Verify `SESSION_LIFETIME_WEB` is set correctly in `.env`
3. Clear Laravel config cache: `php artisan config:clear`

### Session not expiring

1. Check session driver in `config/session.php`
2. Verify session storage is working (database/file/redis)
3. Check if `SESSION_LIFETIME` is overriding the middleware setting

## Files Modified

1. `app/Http/Middleware/SetPlatformSessionLifetime.php` - New middleware
2. `app/Http/Kernel.php` - Registered middleware
3. `.env` - Added configuration variables
4. `mobile/capacitor.config.json` - Added custom header
5. `mobile/mobile/capacitor.config.json` - Added custom header

## Future Enhancements

Possible improvements:
- Add a "Remember Me" option for web users to extend their session
- Implement token-based authentication for mobile app
- Add session activity tracking to extend sessions on activity
- Create an admin panel to view active sessions