Replace 24h absolute auto-lock with configurable idle timer

@shared/api/internal.ts

@@ -13,6 +13,10 @@ import {
 } from "stellar-sdk";
 import BigNumber from "bignumber.js";
 import { INDEXER_URL, INDEXER_V2_URL } from "@shared/constants/mercury";
+import {
+  AutoLockTimeoutMinutes,
+  DEFAULT_AUTO_LOCK_TIMEOUT_MINUTES,
+} from "@shared/constants/autoLock";
 import {
   AssetListResponse,
   AssetsListItem,
@@ -1618,13 +1622,15 @@ export const saveSettings = async ({
   isMemoValidationEnabled,
   isHideDustEnabled,
   isOpenSidebarByDefault,
+  autoLockTimeoutMinutes,
 }: {
   activePublicKey: string;
   isDataSharingAllowed: boolean;
   isMemoValidationEnabled: boolean;
   isHideDustEnabled: boolean;
   isOpenSidebarByDefault: boolean;
-}): Promise<Settings & IndexerSettings> => {
+  autoLockTimeoutMinutes: AutoLockTimeoutMinutes;
+}): Promise<Settings & IndexerSettings & { wasLocked?: boolean }> => {
   let response = {
     allowList: DEFAULT_ALLOW_LIST,
     isDataSharingAllowed: false,
@@ -1638,19 +1644,22 @@ export const saveSettings = async ({
     isNonSSLEnabled: false,
     isHideDustEnabled: true,
     isOpenSidebarByDefault: false,
+    autoLockTimeoutMinutes: DEFAULT_AUTO_LOCK_TIMEOUT_MINUTES,
     error: "",
     hiddenAssets: {},
+    wasLocked: false,
   };
 
   try {
-    response = await sendMessageToBackground({
+    response = (await sendMessageToBackground({
       activePublicKey,
       isDataSharingAllowed,
       isMemoValidationEnabled,
       isHideDustEnabled,
       isOpenSidebarByDefault,
+      autoLockTimeoutMinutes,
       type: SERVICE_TYPES.SAVE_SETTINGS,
-    });
+    })) as unknown as typeof response;
   } catch (e) {
     console.error(e);
   }
@@ -1866,7 +1875,11 @@ export const loadSettings = (): Promise<
   sendMessageToBackground({
     activePublicKey: null,
     type: SERVICE_TYPES.LOAD_SETTINGS,
-  });
+  }) as unknown as Promise<
+    Settings &
+      IndexerSettings &
+      ExperimentalFeatures & { assetsLists: AssetsLists }
+  >;
 
 export const loadBackendSettings = async (): Promise<{
   isSorobanPublicEnabled: boolean;

@shared/api/types/message-request.ts

@@ -11,6 +11,7 @@ import {
   CollectibleKey,
 } from "./types";
 import { AssetsListItem } from "@shared/constants/soroban/asset-list";
+import { AutoLockTimeoutMinutes } from "@shared/constants/autoLock";
 
 export interface TokenToAdd {
   domain: string;
@@ -282,6 +283,11 @@ export interface SaveSettingsMessage extends BaseMessage {
   isMemoValidationEnabled: boolean;
   isDataSharingAllowed: boolean;
   isOpenSidebarByDefault: boolean;
+  autoLockTimeoutMinutes: AutoLockTimeoutMinutes;
+}
+
+export interface UserActivityMessage extends BaseMessage {
+  type: SERVICE_TYPES.USER_ACTIVITY;
 }
 
 export interface SaveExperimentalFeaturesMessage extends BaseMessage {
@@ -547,4 +553,5 @@ export type ServiceMessageRequest =
   | GetHiddenCollectiblesMessage
   | MarkQueueActiveMessage
   | OpenSidebarMessage
-  | RejectSigningRequestMessage;
+  | RejectSigningRequestMessage
+  | UserActivityMessage;

@shared/api/types/types.ts

@@ -13,6 +13,7 @@ import {
   AssetsLists,
   AssetsListItem,
 } from "../../constants/soroban/asset-list";
+import { AutoLockTimeoutMinutes } from "../../constants/autoLock";
 
 export enum ActionStatus {
   IDLE = "IDLE",
@@ -189,6 +190,7 @@ export interface Preferences {
   networksList: NetworkDetails[];
   isHideDustEnabled: boolean;
   isOpenSidebarByDefault: boolean;
+  autoLockTimeoutMinutes: AutoLockTimeoutMinutes;
   error: string;
 }
 

@shared/constants/autoLock.ts

@@ -0,0 +1,27 @@
+/**
+ * Single source of truth for the idle auto-lock timeout feature.
+ *
+ * The browser session is locked after this many minutes of user
+ * inactivity across all extension surfaces (popup, sidebar, standalone
+ * signing windows, grant-access windows). Any user interaction inside
+ * an extension page resets the timer.
+ */
+export const VALID_AUTO_LOCK_TIMEOUT_MINUTES = [1, 5, 15, 30, 60] as const;
+
+export type AutoLockTimeoutMinutes =
+  (typeof VALID_AUTO_LOCK_TIMEOUT_MINUTES)[number];
+
+export const DEFAULT_AUTO_LOCK_TIMEOUT_MINUTES: AutoLockTimeoutMinutes = 15;
+
+export const isValidAutoLockTimeoutMinutes = (
+  value: unknown,
+): value is AutoLockTimeoutMinutes =>
+  typeof value === "number" &&
+  (VALID_AUTO_LOCK_TIMEOUT_MINUTES as readonly number[]).includes(value);
+
+export const coerceAutoLockTimeoutMinutes = (
+  value: unknown,
+): AutoLockTimeoutMinutes =>
+  isValidAutoLockTimeoutMinutes(value)
+    ? value
+    : DEFAULT_AUTO_LOCK_TIMEOUT_MINUTES;

@shared/constants/services.ts

@@ -70,6 +70,7 @@ export enum SERVICE_TYPES {
   CLEAR_RECENT_PROTOCOLS = "CLEAR_RECENT_PROTOCOLS",
   GET_DISCOVER_WELCOME_SEEN = "GET_DISCOVER_WELCOME_SEEN",
   DISMISS_DISCOVER_WELCOME = "DISMISS_DISCOVER_WELCOME",
+  USER_ACTIVITY = "USER_ACTIVITY",
 }
 
 // SIDEBAR_NAVIGATE is a plain string constant (not in an enum) because it is

extension/src/background/ducks/session.ts

@@ -58,6 +58,7 @@ const initialState: InitialState = {
   },
   allAccounts: [] as Account[],
   migratedMnemonicPhrase: "",
+  isHardwareWalletLocked: false,
 };
 
 interface UiData {
@@ -70,6 +71,12 @@ interface AppData {
   privateKey?: string;
   hashKey?: { key: string };
   password?: string;
+  // True once the idle auto-lock alarm fires on a hardware-wallet-active
+  // session. Hot-wallet (mnemonic) sessions are gated by `hashKey`
+  // instead, which `timeoutAccountAccess` already clears. HW sessions
+  // need a dedicated flag because `getIsHardwareWalletActive` is stored
+  // in `localStore` and is not cleared by the lock path.
+  isHardwareWalletLocked?: boolean;
 }
 
 export const sessionSlice = createSlice({
@@ -108,6 +115,19 @@ export const sessionSlice = createSlice({
       },
       password: "",
     }),
+    // Idle auto-lock for hardware-wallet sessions. `timeoutAccountAccess`
+    // clears the hot-wallet `hashKey`, but hardware-wallet "unlocked"
+    // state is read off `localStore.isHardwareWalletActive` and is
+    // unaffected by that — so without this flag, the idle alarm firing
+    // on an HW-only session would be a silent no-op.
+    lockHardwareWallet: (state) => ({
+      ...state,
+      isHardwareWalletLocked: true,
+    }),
+    unlockHardwareWallet: (state) => ({
+      ...state,
+      isHardwareWalletLocked: false,
+    }),
     updateAccountName: (
       state,
       action: { payload: { publicKey: string; updatedAccountName: string } },
@@ -155,6 +175,8 @@ export const {
     logOut,
     setActiveHashKey,
     timeoutAccountAccess,
+    lockHardwareWallet,
+    unlockHardwareWallet,
     setMigratedMnemonicPhrase,
     updateAccountName,
   },
@@ -178,9 +200,17 @@ export const buildHasPrivateKeySelector = (localStore: DataStorageAccess) =>
     const isHardwareWalletActive = await getIsHardwareWalletActive({
       localStore,
     });
-    return isHardwareWalletActive || !!session?.hashKey?.key;
+    if (isHardwareWalletActive && !session?.isHardwareWalletLocked) {
+      return true;
+    }
+    return !!session?.hashKey?.key;
   });
 
+export const isHardwareWalletLockedSelector = createSelector(
+  sessionSelector,
+  (session) => !!session?.isHardwareWalletLocked,
+);
+
 export const hashKeySelector = createSelector(
   sessionSelector,
   (session) => session.hashKey,

extension/src/background/helpers/__tests__/session.test.ts

@@ -2,7 +2,12 @@ import {
   deriveKeyFromString,
   encryptHashString,
   decryptHashString,
+  SessionTimer,
+  SESSION_ALARM_NAME,
 } from "../session";
+import browser from "webextension-polyfill";
+import { AUTO_LOCK_TIMEOUT_MINUTES_ID } from "constants/localStorageTypes";
+import { DEFAULT_AUTO_LOCK_TIMEOUT_MINUTES } from "@shared/constants/autoLock";
 
 describe("session", () => {
   it("should be able to encrypt and decrypt a string", async () => {
@@ -85,3 +90,82 @@ describe("session", () => {
     expect(areEqual).toBe(false);
   });
 });
+
+describe("SessionTimer", () => {
+  const createMock = jest.fn().mockResolvedValue(undefined);
+  const clearMock = jest.fn().mockResolvedValue(undefined);
+
+  beforeEach(() => {
+    createMock.mockClear();
+    clearMock.mockClear();
+    (browser as any).alarms = { create: createMock, clear: clearMock };
+  });
+
+  const makeLocalStore = (stored: unknown) =>
+    ({
+      getItem: jest.fn().mockImplementation((key: string) => {
+        if (key === AUTO_LOCK_TIMEOUT_MINUTES_ID) return Promise.resolve(stored);
+        return Promise.resolve(null);
+      }),
+      setItem: jest.fn(),
+      remove: jest.fn(),
+    }) as any;
+
+  it("resetSession arms the alarm using the stored timeout", async () => {
+    const timer = new SessionTimer(makeLocalStore(30));
+    await timer.resetSession();
+    expect(createMock).toHaveBeenCalledWith(SESSION_ALARM_NAME, {
+      delayInMinutes: 30,
+    });
+  });
+
+  it("startSession is an alias for resetSession", async () => {
+    const timer = new SessionTimer(makeLocalStore(5));
+    await timer.startSession();
+    expect(createMock).toHaveBeenCalledWith(SESSION_ALARM_NAME, {
+      delayInMinutes: 5,
+    });
+  });
+
+  it("falls back to the default when no timeout is persisted", async () => {
+    const timer = new SessionTimer(makeLocalStore(null));
+    await timer.resetSession();
+    expect(createMock).toHaveBeenCalledWith(SESSION_ALARM_NAME, {
+      delayInMinutes: DEFAULT_AUTO_LOCK_TIMEOUT_MINUTES,
+    });
+  });
+
+  it("falls back to the default when the persisted value is invalid", async () => {
+    const timer = new SessionTimer(makeLocalStore(7));
+    await timer.resetSession();
+    expect(createMock).toHaveBeenCalledWith(SESSION_ALARM_NAME, {
+      delayInMinutes: DEFAULT_AUTO_LOCK_TIMEOUT_MINUTES,
+    });
+  });
+
+  it("re-reads the persisted timeout on every reset", async () => {
+    const localStore = {
+      getItem: jest
+        .fn()
+        .mockResolvedValueOnce(15)
+        .mockResolvedValueOnce(60),
+      setItem: jest.fn(),
+      remove: jest.fn(),
+    } as any;
+    const timer = new SessionTimer(localStore);
+    await timer.resetSession();
+    await timer.resetSession();
+    expect(createMock).toHaveBeenNthCalledWith(1, SESSION_ALARM_NAME, {
+      delayInMinutes: 15,
+    });
+    expect(createMock).toHaveBeenNthCalledWith(2, SESSION_ALARM_NAME, {
+      delayInMinutes: 60,
+    });
+  });
+
+  it("stopSession clears the alarm", async () => {
+    const timer = new SessionTimer(makeLocalStore(15));
+    await timer.stopSession();
+    expect(clearMock).toHaveBeenCalledWith(SESSION_ALARM_NAME);
+  });
+});

extension/src/background/helpers/session.ts

@@ -6,26 +6,65 @@ import {
   hashKeySelector,
   SessionState,
   timeoutAccountAccess,
+  lockHardwareWallet,
 } from "../ducks/session";
 import { DataStorageAccess } from "./dataStorageAccess";
-import { TEMPORARY_STORE_ID } from "../../constants/localStorageTypes";
+import {
+  AUTO_LOCK_TIMEOUT_MINUTES_ID,
+  TEMPORARY_STORE_ID,
+} from "../../constants/localStorageTypes";
+import {
+  AutoLockTimeoutMinutes,
+  coerceAutoLockTimeoutMinutes,
+} from "@shared/constants/autoLock";
 import { encode, decode } from "./base64-arraybuffer";
 
-// 24 hours
-const SESSION_LENGTH = 60 * 24;
 export const SESSION_ALARM_NAME = "session-timer";
 
+/**
+ * Idle-based auto-lock timer.
+ *
+ * The browser session is locked after a configurable number of minutes
+ * of user inactivity. Any genuine user interaction in an extension page
+ * pings the background, which calls `resetSession()` to rearm the alarm
+ * at `now + configured timeout`. The alarm is implemented as a named
+ * `browser.alarms` entry, so creating it with the same name replaces
+ * any in-flight deadline atomically — no separate clear step needed.
+ */
 export class SessionTimer {
-  duration = 1000 * 60 * SESSION_LENGTH;
-  runningTimeout: null | ReturnType<typeof setTimeout> = null;
-  constructor(duration?: number) {
-    this.duration = duration || this.duration;
+  private readonly localStore: DataStorageAccess;
+
+  constructor(localStore: DataStorageAccess) {
+    this.localStore = localStore;
   }
 
-  startSession() {
-    browser?.alarms.create(SESSION_ALARM_NAME, {
-      delayInMinutes: SESSION_LENGTH,
-    });
+  private async getTimeoutMinutes(): Promise<AutoLockTimeoutMinutes> {
+    const stored = await this.localStore.getItem(AUTO_LOCK_TIMEOUT_MINUTES_ID);
+    return coerceAutoLockTimeoutMinutes(stored);
+  }
+
+  /**
+   * (Re)arm the auto-lock alarm. Reads the persisted timeout on every
+   * call so that settings changes take effect immediately.
+   */
+  async resetSession() {
+    const delayInMinutes = await this.getTimeoutMinutes();
+    await browser?.alarms.create(SESSION_ALARM_NAME, { delayInMinutes });
+  }
+
+  /**
+   * Alias kept so unlock paths can read naturally
+   * (`sessionTimer.startSession()`).
+   */
+  async startSession() {
+    await this.resetSession();
+  }
+
+  /**
+   * Cancel any pending auto-lock alarm. Used by explicit sign-out.
+   */
+  async stopSession() {
+    await browser?.alarms.clear(SESSION_ALARM_NAME);
   }
 }
 
@@ -266,5 +305,10 @@ export const clearSession = async ({
   sessionStore,
 }: ClearSession) => {
   sessionStore.dispatch(timeoutAccountAccess());
+  // Locks hardware-wallet sessions too. `timeoutAccountAccess` clears
+  // the hot-wallet hashKey, but HW unlocked-state is read from
+  // `localStore.isHardwareWalletActive` and is unaffected — so without
+  // this dispatch the idle alarm would be a no-op on HW-only sessions.
+  sessionStore.dispatch(lockHardwareWallet());
   await localStore.remove(TEMPORARY_STORE_ID);
 };