src/PicoAuthPlugin.php
protected function sessionTimeoutCheck($configKey, $sessKey, $clear, $alwaysUpdate = false)
    {
        if ($this->config[$configKey] !== false) {
            $t = time();
            if ($this->session->has($sessKey)) {
                if ($this->session->get($sessKey) < $t - $this->config[$configKey]) {
                    if ($clear) {
                        $this->session->invalidate();
                    } else {
                        $this->session->migrate(true);
                    }
                    $this->session->set($sessKey, $t);
                } elseif ($alwaysUpdate) {
                    $this->session->set($sessKey, $t);
                }
            } else {
                $this->session->set($sessKey, $t);
            }
        }
    }
protected function sessionTimeoutCheck($configKey, $sessKey, $clear, $alwaysUpdate = false)
    {
        if ($this->config[$configKey] !== false) {
            $t = time();
            if ($this->session->has($sessKey)) {
                if ($this->session->get($sessKey) < $t - $this->config[$configKey]) {
                    if ($clear) {
                        $this->session->invalidate();
                    } else {
                        $this->session->migrate(true);
                    }
                    $this->session->set($sessKey, $t);
                } elseif ($alwaysUpdate) {
                    $this->session->set($sessKey, $t);
                }
            } else {
                $this->session->set($sessKey, $t);
            }
        }
    }
Checks the session timeouts

Checks multiple session timeouts and applies the appropriate
actions, see the usage in {@see PicoAuthPlugin::init()}

@param string $configKey The configuration key containing the timeout value
@param string $sessKey The session key with the deciding timestamp
@param bool $clear If set to true, the session will be destroyed (invalidate)
If set to false, the session will be migrated (change sessid)
@param bool $alwaysUpdate If set to true, the timestamp in the session (under $sessKey)
will be updated on every call, otherwise only on timeout