# RC-004
## Session Lifecycle & Portal Behavior

You are implementing Release Candidate RC-004 for the INVEETAIRE platform.

This is a behavior refinement.

This is NOT feature development.

This is NOT UI redesign.

This is NOT architecture refactoring.

The application has already completed:

✅ BETA-001

✅ RC-001A

✅ RC-001B

✅ RC-002

✅ RC-003

Your objective is to finalize session behavior, portal navigation, and authentication UX before production.

---

Current Environment

Development

http://localhost/inveetaire/

Production

https://inveetaire.com/

Maintain BASE_PATH compatibility.

Never hardcode localhost.

---

Objectives

Implement a professional session lifecycle.

Separate Landing Page behavior from authenticated portal behavior.

Improve security through automatic inactivity logout.

Keep authentication architecture unchanged.

---

Portal Behavior

Root URL

GET /

MUST ALWAYS render the public Landing Page.

Even if the user is already authenticated.

Never redirect authenticated users from "/" directly to a dashboard.

The Landing Page is now considered the public website.

---

Portal Login

GET /admin

If NOT authenticated

↓

Render Admin Login.

If already authenticated as Admin

↓

Redirect to

/app/admin/dashboard

---

GET /couple

If NOT authenticated

↓

Render Couple Login.

If already authenticated as Couple

↓

Redirect to

/app/couple/dashboard

If already authenticated as Crew

↓

Redirect to

/app/crew/dashboard

---

Legacy Login

GET /login

↓

302 Redirect

↓

/couple

Maintain backward compatibility.

---

Logout

Logout must:

Destroy session completely.

Remove active workspace context.

Remove authentication context.

Regenerate session.

Redirect to:

/

Display flash message:

"You have successfully logged out."

---

Session Timeout

Implement inactivity timeout.

Duration:

30 minutes.

The timeout is based on inactivity.

Every authenticated request refreshes the timer.

---

Session Expiration

If inactivity exceeds 30 minutes:

Destroy session.

Regenerate session.

Redirect user back to the appropriate login portal.

Admin

↓

/admin

Couple

↓

/couple

Crew

↓

/couple

Display flash message:

"Your session has expired due to inactivity. Please sign in again."

---

Portal Tracking

Store the login portal inside session.

Example:

portal

↓

admin

or

portal

↓

couple

This value is used only for logout redirection and session expiration.

Do NOT redesign authentication.

---

Landing Page

Authenticated users opening:

/

must still see the Landing Page.

Landing buttons behave as follows:

Guest

↓

Click Couple Login

↓

/couple login

Authenticated Couple

↓

Click Couple Login

↓

Dashboard

Authenticated Crew

↓

Click Couple Login

↓

Crew Dashboard

Authenticated Admin

↓

Click Admin

↓

Admin Dashboard

This keeps Landing as the public homepage while preserving convenient portal entry.

---

Verification

Verify:

GET /

always renders Landing.

Authenticated Admin opening "/"

still sees Landing.

Authenticated Couple opening "/"

still sees Landing.

Authenticated Crew opening "/"

still sees Landing.

GET /admin

redirects authenticated Admin.

GET /couple

redirects authenticated Couple.

GET /couple

redirects authenticated Crew.

Logout destroys session.

Workspace session removed.

30-minute inactivity logout works.

Flash messages display correctly.

BASE_PATH compatibility.

localhost/inveetaire compatibility.

Production compatibility.

PHP syntax passes.

---

Constraints

Do NOT:

Modify business modules.

Modify routing architecture.

Modify WorkspaceService.

Modify Invitation.

Modify Guest.

Modify Messaging.

Modify Operation.

Modify database schema.

Implement Remember Me.

Implement Refresh Token.

Implement JWT.

Implement OAuth.

Implement SSO.

Implement Registration.

---

Acceptance Criteria

PASS only if:

Landing remains public.

Portal auto-login works.

Logout works correctly.

Session timeout works.

Workspace context removed on logout.

Flash messages displayed.

Authentication architecture unchanged.

PHP syntax passes.

---

Output

Provide:

1. Files modified.

2. Session lifecycle implementation.

3. Portal behavior implementation.

4. Timeout implementation.

5. Verification results.

6. Acceptance checklist.

7. PHP syntax results.

Stop after implementation.

Wait for Human Approval.