feat: log staff sign-in and sign-out and force logout at a set time

apps/api/src/auth/jwt.strategy.ts

@@ -34,7 +34,7 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
     });
   }
 
-  async validate(payload: JwtPayload & { typ?: string; mobile?: string }) {
+  async validate(payload: JwtPayload & { typ?: string; mobile?: string; iat?: number }) {
     if (
       payload.typ === 'portal' ||
       payload.typ === 'org-select' ||
@@ -135,6 +135,7 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
         priorGranted && membership.organization.priorArchiveEnabledAt
           ? membership.organization.priorArchiveEnabledAt
           : null,
+      sessionStartedAt: payload.iat ? new Date(payload.iat * 1000) : new Date(),
       ...(viewAsReadOnly && impersonatorUserId
         ? {
             impersonatorUserId,