Consider a Approach, do not mark it as answer.

• nextAuth provides a client side api, called getSession() or a hook called useSession().
• everytime when the user enters the site, it will be authenticated, because i am assuming you have a Private route for validation.
• when he enters, you will get the start time ofcourse.
• when he try to close the session, means he will close the tab, or logout.
• for logout, user will ofcourse click on the signout button.
• for closed a tab by useer, window events will help, i have a event called beforeunload, but not recommended, here is the link, as it is not fully supported, you can do your research on it, and figure out the end time.
• please do not mark this as a final answer. Thank you.