moving lock duration calculations to app instead of endpoint