feat: Add configurable auto logout on inactivity

Users can pick an inactivity timeout in their preferences. A warning
appears 30 seconds before, and activity or a logout is synchronised
across open tabs.

server/api/controllers/users/update.js

@@ -95,6 +95,11 @@
  *                 enum: [byDefault, alphabetically, byCreationTime]
  *                 description: Default sort order for projects display
  *                 example: byDefault
+ *               autoLogoutMode:
+ *                 type: string
+ *                 enum: [never, 2m, 5m, 10m, 30m, 12h]
+ *                 description: Auto-logout behavior on inactivity
+ *                 example: 30m
  *               isDeactivated:
  *                 type: boolean
  *                 description: Whether the user account is deactivated and cannot log in (for admins)
@@ -200,6 +205,10 @@ module.exports = {
       type: 'string',
       isIn: Object.values(User.ProjectOrders),
     },
+    autoLogoutMode: {
+      type: 'string',
+      isIn: Object.values(User.AutoLogoutModes),
+    },
     isDeactivated: {
       type: 'boolean',
     },
@@ -266,6 +275,7 @@ module.exports = {
         'defaultEditorMode',
         'defaultHomeView',
         'defaultProjectsOrder',
+        'autoLogoutMode',
         'isDeactivated',
       ]),
     };

server/api/models/User.js

@@ -142,6 +142,12 @@
  *           default: byDefault
  *           description: Default sort order for projects display (personal field)
  *           example: byDefault
+ *         autoLogoutMode:
+ *           type: string
+ *           enum: [never, 2m, 5m, 10m, 30m, 12h]
+ *           default: 30m
+ *           description: Auto-logout behavior on inactivity (personal field)
+ *           example: 30m
  *         isTotpEnabled:
  *           type: boolean
  *           default: false
@@ -248,6 +254,15 @@ const LANGUAGES = [
 ];
 
 // TODO: find better way to handle apiKeyHash and apiKeyCreatedAt
+const AutoLogoutModes = {
+  NEVER: 'never',
+  MINUTES_2: '2m',
+  MINUTES_5: '5m',
+  MINUTES_10: '10m',
+  MINUTES_30: '30m',
+  HOURS_12: '12h',
+};
+
 const PRIVATE_FIELD_NAMES = [
   'email',
   'apiKeyPrefix',
@@ -272,6 +287,7 @@ const PERSONAL_FIELD_NAMES = [
   'defaultEditorMode',
   'defaultHomeView',
   'defaultProjectsOrder',
+  'autoLogoutMode',
 ];
 
 const INTERNAL = {
@@ -284,6 +300,7 @@ module.exports = {
   EditorModes,
   HomeViews,
   ProjectOrders,
+  AutoLogoutModes,
   LANGUAGES,
   PRIVATE_FIELD_NAMES,
   PERSONAL_FIELD_NAMES,
@@ -413,6 +430,12 @@ module.exports = {
       type: 'ref',
       columnName: 'terms_accepted_at',
     },
+    autoLogoutMode: {
+      type: 'string',
+      isIn: Object.values(AutoLogoutModes),
+      defaultsTo: AutoLogoutModes.MINUTES_30,
+      columnName: 'auto_logout_mode',
+    },
     totpSecret: {
       type: 'string',
       isNotEmptyString: true,

server/db/migrations/20260808120000_add_auto_logout_preference.js

@@ -0,0 +1,14 @@
+/*!
+ * Copyright (c) 2024 PLANKA Software GmbH
+ * Licensed under the Fair Use License: https://github.com/plankanban/planka/blob/master/LICENSE.md
+ */
+
+module.exports.up = (knex) =>
+  knex.schema.alterTable('user_account', (table) => {
+    table.string('auto_logout_mode').notNullable().defaultTo('30m');
+  });
+
+module.exports.down = (knex) =>
+  knex.schema.alterTable('user_account', (table) => {
+    table.dropColumn('auto_logout_mode');
+  });