feat: Auto-lock session after inactivity timeout

[patchmemory]

Summary

Implements task:security/auth/auto-lock-inactivity (RICE: 18) - comprehensive session auto-lock functionality with configurable inactivity timeouts.

Features Implemented

Backend

• Session Lock State: Added locked and locked_at columns to auth_sessions table
• API Endpoints:
  • POST /api/auth/lock - Lock current session
  • POST /api/auth/unlock - Unlock with password verification
  • GET /api/settings/security/auto-lock - Get auto-lock configuration
  • POST /api/settings/security/auto-lock - Save auto-lock configuration
• Auth Manager Methods:
  • lock_session(token) - Lock a session
  • unlock_session(token, password) - Unlock with password validation
  • is_session_locked(token) - Check if session is locked
  • get_session_lock_info(token) - Get lock state and metadata
• Middleware Integration: Returns 423 (Locked) status when session is locked
• Database Migration: Auto-migrates existing databases to add lock columns
• Security Features:
  • Failed unlock attempts logged and tracked
  • Audit logging for all lock/unlock events
  • Server-side lock state (cannot be bypassed client-side)

Frontend

• Activity Monitor: JavaScript class tracking user activity
  • Monitors mouse, keyboard, scroll, and touch events
  • Configurable timeout (1-120 minutes)
  • Checks every 10 seconds for inactivity
• Lock Screen Overlay:
  • Full-screen overlay with password prompt
  • Displays username and lock time
  • Password-only unlock (no username required)
  • Shows error messages for failed attempts
• Settings UI: Auto-lock controls in Settings > General > Security
  • Enable/disable toggle
  • Timeout configuration (1-120 minutes)
  • Integrated with existing security settings save flow

Testing

Unit Tests (12 passing)

• ✅ Session lock/unlock functionality
• ✅ Password verification
• ✅ Lock state tracking
• ✅ Database migration
• ✅ Audit logging
• ✅ Settings storage
• ✅ Edge cases (invalid tokens, wrong passwords, etc.)

All tests passing: pytest tests/test_auto_lock.py -v

Acceptance Criteria

✅ User can enable auto-lock in Settings > General > Security
✅ User can configure inactivity timeout (1-120 minutes)
✅ After configured inactivity period, session is locked
✅ Locked session shows lock screen overlay requiring password
✅ User can unlock with password (no username required)
✅ Activity tracking includes mouse moves, clicks, keyboard input, API calls
✅ Lock screen shows username and time of lock
✅ Failed unlock attempts logged for security
✅ Unit tests verify functionality

Demo Steps

1. Enable authentication in Settings > General > Security
2. Login with test user credentials
3. Enable auto-lock with 1-minute timeout
4. Save settings
5. Wait 1 minute without any activity (mouse/keyboard/scroll)
6. Lock screen overlay appears automatically
7. Enter password to unlock
8. Session resumes exactly where it left off
9. Failed unlock attempts show error messages
10. Check audit log to see lock/unlock events

Files Changed

• scidk/core/auth.py - Session lock/unlock methods and database migration
• scidk/web/routes/api_auth.py - Lock/unlock API endpoints
• scidk/web/routes/api_settings.py - Auto-lock settings endpoints
• scidk/web/auth_middleware.py - Session lock checking
• scidk/ui/templates/base.html - Activity monitor and lock screen UI
• scidk/ui/templates/settings/_general.html - Auto-lock settings controls
• tests/test_auto_lock.py - Comprehensive unit tests (12 tests)

Related Tasks

• Depends on: task:security/auth/basic-authentication ✅ (completed)
• Part of security enhancement story

🤖 Generated with Claude Code