{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "portal-session-warning-extension-contract",
  "group": "portal-delivery",
  "title": [
    "A portal timeout needs a usable extension path",
    "门户超时前，要有可用的延期路径"
  ],
  "intro": [
    "A long supplier application can expire while someone gathers documents or uses assistive technology. Commission the warning and extension path as part of authentication, separately from saving a draft. A saved draft does not prove the user received enough time to complete the current task.",
    "填写供应商申请时，用户查资料或使用辅助技术可能使会话到期。超时警告与延期是身份流程的一部分，应和草稿保存分别验收。保存了草稿，不证明当前任务给了足够操作时间。"
  ],
  "facts": [
    [
      "WCAG 2.2.1 offers turn-off, adjustment or extension routes, with defined exceptions. The extension route includes at least20 seconds to respond and at least10 extensions; security-related timeouts are not automatically exempt.",
      "WCAG 2.2.1提供关闭、调整或延期路径，并列明确例外；延期路径至少给20秒响应、至少可延期10次，安全相关超时不自动豁免。",
      "https://www.w3.org/WAI/WCAG22/Understanding/timing-adjustable.html"
    ]
  ],
  "example": [
    [
      [
        "Synthetic session expires at 10:00:00",
        "Warning begins09:59:30",
        "30 seconds to act; simple extension control available"
      ],
      [
        "合成会话10:00:00到期",
        "09:59:30开始警告",
        "有30秒响应，提供简单延期控件"
      ]
    ],
    [
      [
        "Same expiry; warning09:59:50",
        "Only10 seconds remain",
        "Fails this selected extension route"
      ],
      [
        "同一截止，09:59:50才警告",
        "仅剩10秒",
        "不满足本例选择的延期路径"
      ]
    ],
    [
      [
        "User requests extension number 10",
        "Policy allows10 extensions",
        "Still permit the tenth, not only nine"
      ],
      [
        "用户请求第10次延期",
        "规则允许10次",
        "须允许第10次，不是只给9次"
      ]
    ],
    [
      [
        "Session already expired",
        "Attempt extension",
        "Do not silently bypass authentication; offer approved recovery"
      ],
      [
        "会话已过期",
        "请求延期",
        "不能静默绕过身份验证；提供批准的恢复路径"
      ]
    ]
  ],
  "steps": [
    [
      "List each timer, its owner and any claimed exception. Have the security/accessibility reviewers choose a supported route rather than adding a warning to every timer without analysis.",
      "列明每个计时器、负责人及例外主张，由安全与无障碍负责人选择路径，不机械给所有计时器加弹窗。"
    ],
    [
      "Replay warning time, minimum response period and extension count using a controllable test clock. Record focus, announcement and the fields retained after extension.",
      "用可控测试时钟重放警告、响应时间及延期次数，记录焦点、播报及延期后保留字段。"
    ],
    [
      "Exercise expiry separately from draft recovery. Confirm the server agrees with the renewed deadline and never treats a local countdown as new authority.",
      "另测到期与草稿恢复，确认服务端认可新截止，不把本地倒计时当新的访问权限。"
    ]
  ],
  "result": [
    "The first row has a30second opportunity; the second has10 and fails the selected route even if its button works. The tenth-extension boundary prevents an off-by-one acceptance. A security reviewer may identify an applicable exception, but that needs its own justification and cannot be inferred from the word “secure”.",
    "首行给30秒，第二行仅10秒，即使按钮能点也不满足所选路径。第10次边界避免少给一次。安全负责人可另行论证适用例外，但不能只凭“安全”二字推断。"
  ],
  "accept": [
    "Require a usable supported timing route and consistent client/server expiry. Keep authentication recovery and retained data within the approved security policy.",
    "须有可用的受支持时间路径，前后端截止一致；身份恢复及数据保留仍须符合已批准安全策略。"
  ],
  "limit": [
    "Synthetic timing, no login, token change or timeout-policy modification. The example does not weaken MFA, extend third-party credentials or certify WCAG conformance.",
    "合成时间模型，未登录、改令牌或超时策略；不降低MFA、不延长第三方凭证，也不认证WCAG。"
  ],
  "oldLinks": []
}