Fix session expiry message

[sheonhan]

Status

Ready for Review

Description of Changes

Fixes #5197

• Use two new properties (generate_flow_record and login_record) to distinguish users who have logged in before or those who have gone through the codename generation flow.

Testing

• Added a test to check session timeout messages aren't displayed after SESSION_EXPIRATION_MINUTES.

Checklist

If you made changes to the server application code:

• Linting (make lint) and tests (make test) pass in the development container

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

[eloquence]

Hi @sheonhan, thanks for working on this! :) It looks like you accidentally included a few unrelated comits in this PR: https://github.com/freedomofpress/securedrop/pull/5582/commits

Just let us know if you need help resolving.

[sheonhan]

Hi @eloquence, thanks for your quick reply. Looks like I made a mistake while trying to rebase it 😅 . Will clean up and push it again with clean commits!

[sheonhan]

I addressed this issue by creating two new properties (generate_flow_record and login_record) to distinguish users who have logged in before or those who have gone through the codename generation flow.

But I wasn't sure if persisting two properties across sessions—even though they are simple boolean values—is discouraged from a security standpoint. I'd love feedbacks on whether this is an acceptable approach.

[rmol]

Had one suggestion for the property naming. Otherwise this looks good.