Modify Session Timeout Logic

[mrafie1]

Proposed Changes

• Added intervalId variable to track whether polling is occurring (whenever setInterval() is called)
• Added startPolling function to replace the logic of the previous implementation of domContentLoadedCB function
• Added stopPolling function to call clearInterval to pause polling
• Added a new event listener using "Page Visibility API" to track whether the tab is focused.
  • Stops polling when the user switches to another tab.
  • Stops polling when the browser is minimized.
  • Restarts when the user returns.
  • Consistent behavior across modern browsers.

Screenshots of your changes (if applicable)

This had audio explaining how I tested my changes

Screen.Recording.2026-07-21.at.21.31.02.mov

Type of Change

(Write an X or a brief description next to the type or types that best describe your changes.)

Type	Applies?
🚨 Breaking change (fix or feature that would cause existing functionality to change)
✨ New feature (non-breaking change that adds functionality)	x
🐛 Bug fix (non-breaking change that fixes an issue)
🎨 User interface change (change to user interface; provide screenshots)
♻️ Refactoring (internal change to codebase, without changing functionality)
🚦 Test update (change that only adds or modifies tests)
📦 Dependency update (change that updates a dependency)
📖 Documentation update (change that updates documentation)
🔧 Internal (change that only affects developers or continuous integration)

Checklist

(Complete each of the following items for your pull request. Indicate that you have completed an item by changing the [ ] into a [x] in the raw text, or by clicking on the checkbox in the rendered description on GitHub.)

Before opening your pull request:

• I have performed a self-review of my changes.
  • Check that all changed files included in this pull request are intentional changes.
  • Check that all changes are relevant to the purpose of this pull request, as described above.
• I have added tests for my changes, if applicable.
  • This is required for all bug fixes and new features.
• I have updated the project documentation, if applicable.
  • This is required for new features.
• If this is my first contribution, I have added myself to the list of contributors.

After opening your pull request:

• I have updated the project Changelog (this is required for all changes).
• I have verified that the pre-commit.ci checks have passed.
• I have verified that the CI tests have passed.
• I have reviewed the test coverage changes reported by Coveralls.
• I have requested a review from a project maintainer.

Questions and Comments

(Include any questions or comments you have regarding your changes.)

Whenever a user is forcibly logged off due to an expired session but still remains on the MarkUs screen and doesn't redirect themselves to the "log-in" page, polling still occurs (this was tracked using console.log() statements). Is this intended?

Do I need to update any documentation for this change? I wasn't able to find a section in the documentation that seemed relevant.

[coveralls]

Coverage Report for CI Build 30213359923

Coverage decreased (-0.005%) to 90.467%

Details

• Coverage decreased (-0.005%) from the base build.
• Patch coverage: 4 uncovered changes across 1 file (1 of 5 lines covered, 20.0%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
app/controllers/main_controller.rb	5	1	20.0%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	51487
Covered Lines:	47607
Line Coverage:	92.46%
Relevant Branches:	2484
Covered Branches:	1219
Branch Coverage:	49.07%
Branches in Coverage %:	Yes
Coverage Strength:	128.23 hits per line

---

💛 - Coveralls

[david-yz-liu]

Nice work @mrafie1, this PR looks great. You raised a great question about the "post-login" calls to check_timeout. It would be great to extend this PR to also stop calls to check_timeout after a forbidden status has been provided and the "redirect to login" modal appears.

[mrafie1]

From slack:
I changed the code so that when the user is on the "session expired" modal, they are unable to poll the server. However, what I had trouble doing was disabling polling when the user is on the "imminent expiry" modal but they have already "timed out" (I've attatched a video of me doing this, the console will print "polling" each time the user polls the server) .

Screen.Recording.2026-07-24.at.21.51.34.mov

This is because the user is only forwarded to the "session expired" modal when they press "continue" and the server sends a 403 response, which I can pick up with my listener. Does your comment on github also encompass this issue? If so, is there a way to actually detect when the user should be timed out without using a 403 response?

[david-yz-liu]

Hi @mrafie1, please modify the check_timeout controller method to respond with a 401 (Unauthorized) status code when the session has expired. You can then go ahead and check for that when making the request on the front-end.

[mrafie1]

Video of changes: Polling period is 5 seconds and timeout period is 20 seconds.

screenrec1.mov

[david-yz-liu]

I'd rather not introduce this as a global handler, but instead attach it directly to the fetch request to check_timeout.

Related to this, please modify the existing code to use the native fetch instead of $.get

[mrafie1]

• Replaced $.get.. with fetch()
  • Added response status checking, turning off polling when response is 401
  • From lines 33 to 37, added functionality to display the "youre about to be logged off" modal when timeout is imminent