# RC-004 ## Session Lifecycle & Portal Behavior You are implementing Release Candidate RC-004 for the INVEETAIRE platform. This is a behavior refinement. This is NOT feature development. This is NOT UI redesign. This is NOT architecture refactoring. The application has already completed: ✅ BETA-001 ✅ RC-001A ✅ RC-001B ✅ RC-002 ✅ RC-003 Your objective is to finalize session behavior, portal navigation, and authentication UX before production. --- Current Environment Development http://localhost/inveetaire/ Production https://inveetaire.com/ Maintain BASE_PATH compatibility. Never hardcode localhost. --- Objectives Implement a professional session lifecycle. Separate Landing Page behavior from authenticated portal behavior. Improve security through automatic inactivity logout. Keep authentication architecture unchanged. --- Portal Behavior Root URL GET / MUST ALWAYS render the public Landing Page. Even if the user is already authenticated. Never redirect authenticated users from "/" directly to a dashboard. The Landing Page is now considered the public website. --- Portal Login GET /admin If NOT authenticated ↓ Render Admin Login. If already authenticated as Admin ↓ Redirect to /app/admin/dashboard --- GET /couple If NOT authenticated ↓ Render Couple Login. If already authenticated as Couple ↓ Redirect to /app/couple/dashboard If already authenticated as Crew ↓ Redirect to /app/crew/dashboard --- Legacy Login GET /login ↓ 302 Redirect ↓ /couple Maintain backward compatibility. --- Logout Logout must: Destroy session completely. Remove active workspace context. Remove authentication context. Regenerate session. Redirect to: / Display flash message: "You have successfully logged out." --- Session Timeout Implement inactivity timeout. Duration: 30 minutes. The timeout is based on inactivity. Every authenticated request refreshes the timer. --- Session Expiration If inactivity exceeds 30 minutes: Destroy session. Regenerate session. Redirect user back to the appropriate login portal. Admin ↓ /admin Couple ↓ /couple Crew ↓ /couple Display flash message: "Your session has expired due to inactivity. Please sign in again." --- Portal Tracking Store the login portal inside session. Example: portal ↓ admin or portal ↓ couple This value is used only for logout redirection and session expiration. Do NOT redesign authentication. --- Landing Page Authenticated users opening: / must still see the Landing Page. Landing buttons behave as follows: Guest ↓ Click Couple Login ↓ /couple login Authenticated Couple ↓ Click Couple Login ↓ Dashboard Authenticated Crew ↓ Click Couple Login ↓ Crew Dashboard Authenticated Admin ↓ Click Admin ↓ Admin Dashboard This keeps Landing as the public homepage while preserving convenient portal entry. --- Verification Verify: GET / always renders Landing. Authenticated Admin opening "/" still sees Landing. Authenticated Couple opening "/" still sees Landing. Authenticated Crew opening "/" still sees Landing. GET /admin redirects authenticated Admin. GET /couple redirects authenticated Couple. GET /couple redirects authenticated Crew. Logout destroys session. Workspace session removed. 30-minute inactivity logout works. Flash messages display correctly. BASE_PATH compatibility. localhost/inveetaire compatibility. Production compatibility. PHP syntax passes. --- Constraints Do NOT: Modify business modules. Modify routing architecture. Modify WorkspaceService. Modify Invitation. Modify Guest. Modify Messaging. Modify Operation. Modify database schema. Implement Remember Me. Implement Refresh Token. Implement JWT. Implement OAuth. Implement SSO. Implement Registration. --- Acceptance Criteria PASS only if: Landing remains public. Portal auto-login works. Logout works correctly. Session timeout works. Workspace context removed on logout. Flash messages displayed. Authentication architecture unchanged. PHP syntax passes. --- Output Provide: 1. Files modified. 2. Session lifecycle implementation. 3. Portal behavior implementation. 4. Timeout implementation. 5. Verification results. 6. Acceptance checklist. 7. PHP syntax results. Stop after implementation. Wait for Human Approval.