Manage login session in desktop application: in which layer?

Question

I have to fulfill the following requirement:

[...]if the logged user is idle for more than 30 minutes, he has to be logged out.

where idle means "doesn't press mouse nor keyboard".

Now, I was pretty sure about how to achieve this when I first read it: to me it sounded like a requirement that has to do with business logic, so I should have realized it in the business layer (having a 3-layers architecture).
Here some code:

// simplified and generalized version of my login method
public boolean login(String email, String password) {
    user = dao.read(email, password); //returns either null or the user
    boolean logged = user != null;
    if (logged) {
       // initialize Session somehow, let's say for example:
        Session.start();
    }
    return logged;
}

// simplified and generalized version of my logout method
public void logout() {
    operatore = null;
    // terminate Session somehow, let's say for example:
    Session.destroy();
}

This would be ideal, but there's one problem: Session should know how to detect user inactivity (and then fire logout() method)... but unfortunately this entirely depends on how the GUI is made!
[just to be clear: I know I to achieve this, but I'd like to do it independently on how I realize UI (e.g. Java Swing, command-line, web-based, etc)]

I mean, business layer can't (and shouldn't imo) catch user events/interaction so I should necessary realize Session in the GUI package and use it from there: in my design a layer should only interact with its strictly lower layer's interfaces and should not know anything about any higher level (Data Access Layer is indipendent (well, it depends on DB and other persistence mechanism), Business Layer only depends on Data Access Layer interfaces, Presentation Layer only depends on Business Layer interfaces).

The problem is that just sounds wrong to me realize part of what I consider to be a business logic requirement in the presentation layer.

Btw, session expiring probably has to do too much with presentation logic since has to "listen" user inputs.

This reminds me of another pertinent question which I answered myself some time ago, but I'm going to ask this one too just to avoid any doubt: link to the question.

I'd like to hear some opinion in merit, mainly focused on good design practices.

Answer 1

As the requirement says

if the logged user is idle for more than 30 minutes, he has to be logged out.

So here inputs are key board or mouse activity. Of course this belongs to Presentation Layer.

In web application scenario, the Mouse/Keyboard activity (Utility) module trigger session time out.

We can use Observer/Listener pattern. If it is in java

http://www.vogella.com/articles/DesignPatternObserver/article.html will be helpful

Using httpsession listners we can pass this activity into Business Layer. That means you can call Business Layer functionality to do the clean up.

In desk top scenario, we can use Swing application where similar pattern can be used.

So the point is Presentation layer informs the other layers based on the input provided by the Utility Class.