setting, session and profile

backend/app/services/session_policy.py

@@ -0,0 +1,47 @@
+"""Session duration policy for accounts and organizations."""
+
+from __future__ import annotations
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.models import Account
+from app.services.org_security import get_or_create_security_settings
+
+DEFAULT_SESSION_TIMEOUT_MINUTES = 10_080  # 1 week
+
+ALLOWED_SESSION_TIMEOUTS = (
+    60,       # 1 hour
+    120,      # 2 hours
+    240,      # 4 hours
+    480,      # 8 hours
+    720,      # 12 hours
+    1_440,    # 1 day
+    2_880,    # 2 days
+    4_320,    # 3 days
+    7_200,    # 5 days
+    10_080,   # 1 week
+    20_160,   # 2 weeks
+    43_200,   # 30 days
+    64_800,   # 45 days
+    86_400,   # 60 days
+    129_600,  # 90 days
+)
+
+ALLOWED_SESSION_TIMEOUT_SET = set(ALLOWED_SESSION_TIMEOUTS)
+
+
+def validate_session_timeout_minutes(minutes: int) -> None:
+    if minutes not in ALLOWED_SESSION_TIMEOUT_SET:
+        allowed = ", ".join(str(value) for value in ALLOWED_SESSION_TIMEOUTS)
+        raise ValueError(f"Session timeout must be one of: {allowed}")
+
+
+async def resolve_session_timeout_minutes(
+    session: AsyncSession,
+    account: Account,
+) -> int:
+    timeout = account.session_timeout_minutes or DEFAULT_SESSION_TIMEOUT_MINUTES
+    if account.company_domain:
+        org = await get_or_create_security_settings(session, account.company_domain)
+        timeout = min(timeout, org.session_timeout_minutes)
+    return timeout