Keep login sessions persistent across browser restarts

app/__init__.py

@@ -5,7 +5,7 @@ from pathlib import Path
 from zoneinfo import ZoneInfo
 
 import click
-from flask import Flask, render_template, request
+from flask import Flask, render_template, request, session
 
 from .extensions import csrf, db, limiter, login_manager, migrate
 
@@ -21,7 +21,9 @@ def create_app(config=None):
         SESSION_COOKIE_HTTPONLY=True,
         SESSION_COOKIE_SAMESITE="Lax",
         SESSION_COOKIE_SECURE=production,
-        PERMANENT_SESSION_LIFETIME=timedelta(days=7),
+        # Effectively unlimited application lifetime; browsers may cap cookie retention.
+        PERMANENT_SESSION_LIFETIME=timedelta(days=36500),
+        SESSION_REFRESH_EACH_REQUEST=True,
         MAX_CONTENT_LENGTH=16 * 1024 * 1024,
         LOCAL_SETUP=not production,
         DATA_ROOT=os.environ.get("DATA_ROOT", str(ROOT / "data" / "garmin")),
@@ -98,6 +100,12 @@ def create_app(config=None):
     def load_user(user_id):
         return db.session.get(User, int(user_id)) if user_id.isdigit() else None
 
+    @app.before_request
+    def persist_login_session():
+        # Also upgrade existing signed-in browser sessions on their next request.
+        if "_user_id" in session:
+            session.permanent = True
+
     @app.template_filter("duration")
     def duration(value):
         value = round(value or 0)

app/routes.py

@@ -120,6 +120,7 @@ def register_user(is_setup=False):
         return "That email is already registered."
     session.clear()
     login_user(user)
+    session.permanent = True
     flash(
         f"Welcome to Stride. {count} activities imported privately."
         if count
@@ -168,6 +169,7 @@ def login():
         if user and valid and len(password) <= 128:
             session.clear()
             login_user(user)
+            session.permanent = True
             return redirect(url_for("web.dashboard"))
         error = "Email or password was not recognised."
     return render_template("auth.html", mode="login", error=error)