feat: per-client token expiration settings and resolver

Author: sricharan-varanasi

src/apps/authentication/services/security.py

@@ -18,14 +18,35 @@
 from apps.users.domain import User
 from apps.users.password_validation import PasswordValidator
 from config import settings
+from infrastructure.http.domain import MindloggerContentSource
 
 __all__ = ["AuthenticationService"]
 
+_WEB_ADMIN_CLIENTS = (MindloggerContentSource.web, MindloggerContentSource.admin)
+
 
 class AuthenticationService:
     def __init__(self, session) -> None:
         self.session = session
 
+    @staticmethod
+    def token_expiration_minutes(
+        client: MindloggerContentSource | None,
+        default_minutes: int,
+        web_admin_minutes: int | None,
+    ) -> int:
+        """Resolve a token lifetime for a client.
+
+        Web/admin clients get ``web_admin_minutes`` when it is configured;
+        everything else (mobile, or an unknown/legacy client with no `client`
+        claim) keeps ``default_minutes``. An unset ``web_admin_minutes`` means
+        the per-client shortening is off, so all clients fall back to the
+        default — this is what keeps the feature a no-op until ops opts in.
+        """
+        if client in _WEB_ADMIN_CLIENTS and web_admin_minutes is not None:
+            return web_admin_minutes
+        return default_minutes
+
     @staticmethod
     def create_access_token(data: dict) -> str:
         to_encode = data.copy()

src/apps/authentication/tests/unit/test_token_expiration.py

@@ -0,0 +1,29 @@
+import pytest
+
+from apps.authentication.services.security import AuthenticationService
+from infrastructure.http.domain import MindloggerContentSource
+
+DEFAULT = 30
+WEB_ADMIN = 15
+
+
+@pytest.mark.parametrize(
+    "client",
+    (MindloggerContentSource.web, MindloggerContentSource.admin),
+)
+def test_web_admin_use_short_lifetime_when_configured(client: MindloggerContentSource):
+    assert AuthenticationService.token_expiration_minutes(client, DEFAULT, WEB_ADMIN) == WEB_ADMIN
+
+
+@pytest.mark.parametrize(
+    "client",
+    (MindloggerContentSource.web, MindloggerContentSource.admin),
+)
+def test_web_admin_fall_back_to_default_when_unset(client: MindloggerContentSource):
+    assert AuthenticationService.token_expiration_minutes(client, DEFAULT, None) == DEFAULT
+
+
+@pytest.mark.parametrize("web_admin_minutes", (WEB_ADMIN, None))
+@pytest.mark.parametrize("client", (MindloggerContentSource.mobile, None))
+def test_mobile_and_unknown_always_use_default(client, web_admin_minutes):
+    assert AuthenticationService.token_expiration_minutes(client, DEFAULT, web_admin_minutes) == DEFAULT

src/config/authentication.py

@@ -7,6 +7,9 @@ class AccessTokenSettings(BaseModel):
     secret_key: str
     # Set in minutes
     expiration: int = 30
+    # Shorter lifetime (minutes) for web/admin clients. None = same as `expiration`
+    # (feature off). See AuthenticationService.token_expiration_minutes.
+    web_admin_expiration: int | None = None
 
     @field_validator("secret_key")
     @classmethod
@@ -20,6 +23,9 @@ class RefreshTokenSettings(BaseModel):
     secret_key: str
     # Set in minutes
     expiration: int = 540
+    # Shorter lifetime (minutes) for web/admin clients. None = same as `expiration`
+    # (feature off). See AuthenticationService.token_expiration_minutes.
+    web_admin_expiration: int | None = None
 
     transition_key: str | None = None
     transition_expire_date: datetime.date | None = None