# SKEVER Portal V1 — Session Security Patch

Target: `portal-v1.skeversupplies.co.ke`

## 1. Upload
Upload `accounts/session_security.py` to:
`/home/skeversu/skever-portal-v1/accounts/session_security.py`

## 2. Edit config/settings.py
Add this setting near the session/security section:

```python
SKEVER_SESSION_TIMEOUT_SECONDS = 120
```

Add this middleware immediately after Django AuthenticationMiddleware:

```python
"accounts.session_security.SessionSecurityMiddleware",
```

The relevant order should be:

```python
"django.contrib.auth.middleware.AuthenticationMiddleware",
"accounts.session_security.SessionSecurityMiddleware",
"django.contrib.messages.middleware.MessageMiddleware",
```

## 3. Dashboard warning
The browser warning script is supplied as `session-security.js`.
Add it to the authenticated dashboard template immediately before `</body>`:

```html
<script src="/static/session-security.js"></script>
```

If you are not using a static-file directory for this template, paste the JavaScript directly into the dashboard template instead.

## 4. Visible logout
Use a POST form, not a GET link, wherever the persistent sidebar is rendered:

```html
<form method="post" action="{% url 'logout' %}" class="sidebar-logout-form">
  {% csrf_token %}
  <button type="submit" class="sidebar-logout">↪ Sign Out</button>
</form>
```

## 5. Important
This patch intentionally does NOT modify existing Order, Payment, Dispatch, or AuditEvent models.
It also does NOT delete or alter business data when a session expires.

After uploading:
1. Save settings.py.
2. Restart/reload the Python application in cPanel.
3. Log in.
4. Leave the dashboard untouched for 90 seconds.
5. Confirm the warning appears.
6. At 120 seconds, confirm the login screen appears.
7. Log in again and confirm the dashboard still works.

Do not run migrations for this patch.