feat: implement sliding session - extend TTL on each authenticated request

app/core/auth.py

@@ -108,6 +108,12 @@ async def get_session_data(redis: aioredis.Redis, session_id: str) -> dict[str,
     return json.loads(raw)
 
 
+async def refresh_session_ttl(redis: aioredis.Redis, session_id: str) -> None:
+    """Extend the Redis session TTL on activity (sliding session)."""
+    settings = get_settings()
+    await redis.expire(f"session:{session_id}", settings.session_ttl_seconds)
+
+
 async def invalidate_session(redis: aioredis.Redis, session_id: str) -> None:
     """Delete a session from Redis (logout). PostgreSQL record persists."""
     await redis.delete(f"session:{session_id}")

app/core/middleware.py

@@ -83,6 +83,9 @@ class CSRFMiddleware(BaseHTTPMiddleware):
                         status_code=status.HTTP_403_FORBIDDEN,
                         content={"detail": "CSRF token mismatch", "code": "csrf_token_mismatch"},
                     )
+
+                # Sliding session: also extend TTL on CSRF-validated unsafe requests
+                await redis.expire(f"session:{session_id}", settings.session_ttl_seconds)
             finally:
                 await redis.close()