Issue 15: Session Lifespan Watches Synced Directly to Hardware Key Constraints

[elizabetheonoja-art]

Scope

File: src/services/session.ts

Problem

When a user locks or disconnects their browser-based wallet, the backend API session remains active. A malicious actor with access to the unattended machine can continue to perform authenticated actions until the session timer expires.

Requirements

1. Implement monitorWalletLock(address, onLocked) that polls wallet existence every 2 seconds and calls onLocked() immediately if gone.
2. Implement createSession(address, network, ttlMs) storing { address, network, token, issuedAt, expiresAt }.
3. Implement getSession() that checks expiry.
4. Implement validateSession(address) checking address match and expiry.
5. Implement destroySession() wiping storage.
6. Implement refreshSession() extending by 30 min if within 5 min of expiry.
7. Implement onSessionChange(fn) for React hook subscriptions.

Resolution Strategy

• Token format: st-{addressPrefix}-{timestamp-base36}.
• Auto-refresh timer every 60s.
• monitorWalletLock returns cleanup function for useEffect.

Tags

services, session, security, wallet

[Husten150]

as a good developer, with an experience of years, i have read the description and would love to work on it.

[grantfox-oss]

🦊 GrantFox — @Husten150 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #22)
2. Your PR will be reviewed by the Utility-Protocol maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@Husten150's PR #24 was approved and merged by @elizabetheonoja-art.

🏆 @Husten150: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (48 total points). Track your full progress on GrantFox.

👏 Great work, @Husten150! Keep contributing to Utility-Protocol.