title: Manage login session in desktop application: in which layer?
body: <p>I have to  fulfill the following requirement:</p>
  
  <blockquote>
    <p>[...]if the logged user is idle for more than 30 minutes, he has to be logged out.</p>
  </blockquote>
  
  <p>where <em>idle</em> means "doesn't press mouse nor keyboard".</p>
  
  <p>Now, I was pretty sure about how to achieve this when I first read it: to me it sounded like a requirement that has to do with business logic, so I should have realized it in the business layer (having a 3-layers architecture).<br />
  Here some code:</p>
  
  <pre><code>// simplified and generalized version of my login method
  public boolean login(String email, String password) {
      user = dao.read(email, password); //returns either null or the user
      boolean logged = user != null;
      if (logged) {
         // initialize Session somehow, let's say for example:
          Session.start();
      }
      return logged;
  }
  
  // simplified and generalized version of my logout method
  public void logout() {
      operatore = null;
      // terminate Session somehow, let's say for example:
      Session.destroy();
  }
  </code></pre>
  
  <p>This would be ideal, but there's one problem: <code>Session</code> should know how to detect user inactivity (and then fire <code>logout()</code> method)... but unfortunately this entirely depends on how the GUI is made!<br />
  [just to be clear: I know I to achieve this, but I'd like to do it independently on how I realize UI (e.g. Java Swing, command-line, web-based, etc)]</p>
  
  <p>I mean, business layer can't (and shouldn't imo) catch user events/interaction so I should necessary realize <code>Session</code> in the GUI package <strong><em>and</em></strong> <em>use it from there</em>: in my design a layer should only interact with its strictly lower layer's interfaces and should not know anything about any higher level (Data Access Layer is indipendent (well, it depends on DB and other persistence mechanism), Business Layer only depends on Data Access Layer interfaces, Presentation Layer only depends on Business Layer interfaces).</p>
  
  <p>The problem is that just sounds wrong to me realize part of what I consider to be a business logic requirement in the presentation layer.</p>
  
  <p>Btw, session expiring probably has to do too much with presentation logic since has to "listen" user inputs.</p>
  
  <p>This reminds me of another pertinent question which I answered myself some time ago, but I'm going to ask this one too just to avoid any doubt: <a href="https://stackoverflow.com/questions/12423767/business-layer-and-presentation-layer-responsibilities">link to the question</a>.</p>
  
  <p>I'd like to hear some opinion in merit, mainly focused on good design practices.</p>