feat(auth): add 10-minute inactivity auto-logout

shop/lib/supabase/proxy.ts

@@ -119,8 +119,34 @@ export async function updateSession(request: NextRequest) {
   //    the cookies!
   // 4. Finally:
   //    return myNewResponse
-  // If this is not done, you may be causing the browser and server to go out
-  // of sync and terminate the user's session prematurely!
+  // Inaktivitäts-Prüfung serverseitig (10 Minuten = 600.000 ms)
+  const INACTIVITY_TIMEOUT_MS = 10 * 60 * 1000;
+
+  if (user?.sub && !request.nextUrl.pathname.startsWith("/auth")) {
+    const lastActivityCookie = request.cookies.get("webshop-last-activity");
+    const now = Date.now();
+
+    if (lastActivityCookie?.value) {
+      const lastActivityTime = parseInt(lastActivityCookie.value, 10);
+      if (!isNaN(lastActivityTime) && now - lastActivityTime > INACTIVITY_TIMEOUT_MS) {
+        // Länger als 10 Minuten inaktiv -> Auf dem Server sofort abmelden
+        const url = request.nextUrl.clone();
+        url.pathname = "/auth/login";
+        url.searchParams.set("message", "inactivity");
+        const response = NextResponse.redirect(url);
+        response.cookies.delete("webshop-auth-token");
+        response.cookies.delete("webshop-last-activity");
+        return response;
+      }
+    }
+
+    // Aktuellen Zeitstempel in Cookie schreiben
+    supabaseResponse.cookies.set("webshop-last-activity", now.toString(), {
+      path: "/",
+      sameSite: "lax",
+      httpOnly: false, // Für Client-Zugriff lesbar/schreibbar
+    });
+  }
 
   return supabaseResponse;
 }