From 4ec4c7350e21117287469d788f2f053d5148cacd Mon Sep 17 00:00:00 2001
From: husten150 <hustenisama@gmail.com>
Date: Tue, 16 Jun 2026 17:06:09 +0100
Subject: [PATCH] fix: sync session lifespan watches directly to hardware key
 constraints

The monitorWalletLock function previously polled the session storage
(utility-session) to detect wallet disconnection, which meant the backend
API session remained active even after wallet disconnect until the TTL
expired.

Now monitorWalletLock checks the actual wallet connection state
(utility-wallet-session) directly. When the wallet is disconnected,
the session is destroyed immediately, preventing unauthorized access
from unattended machines.

Closes #22
---
 src/services/session.ts | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/services/session.ts b/src/services/session.ts
index 769a8ed..b2b1b6b 100644
--- a/src/services/session.ts
+++ b/src/services/session.ts
@@ -11,6 +11,7 @@ interface SessionPayload {
 }
 
 const SESSION_KEY = "utility-session";
+const WALLET_SESSION_KEY = "utility-wallet-session";
 const REFRESH_INTERVAL = 60_000;
 
 let refreshTimer: ReturnType<typeof setInterval> | null = null;
@@ -113,13 +114,24 @@ function stopRefreshTimer() {
   }
 }
 
+function isWalletConnected(address: string): boolean {
+  try {
+    const raw = localStorage.getItem(WALLET_SESSION_KEY);
+    if (!raw) return false;
+    const parsed = JSON.parse(raw);
+    return parsed.address === address;
+  } catch {
+    return false;
+  }
+}
+
 export function monitorWalletLock(
   address: string,
   onLocked: () => void
 ): () => void {
   const interval = setInterval(() => {
-    const session = getSession();
-    if (!session || session.address !== address) {
+    if (!isWalletConnected(address)) {
+      destroySession();
       onLocked();
       clearInterval(interval);
     }