feat: set web/admin token lifetimes to 15m access / 30m refresh

Author: sricharan-varanasi

.env.default

@@ -36,10 +36,11 @@ AUTHENTICATION__REFRESH_TOKEN__SECRET_KEY="secret2"
 AUTHENTICATION__MFA_TOKEN__SECRET_KEY="secret3"
 AUTHENTICATION__ACCESS_TOKEN__EXPIRATION=30
 AUTHENTICATION__REFRESH_TOKEN__EXPIRATION=540
-# Optional shorter token lifetimes (minutes) for web/admin clients. Unset = same as the
-# values above (feature off). Mobile and unknown/legacy clients always use the values above.
-#AUTHENTICATION__ACCESS_TOKEN__WEB_ADMIN_EXPIRATION=
-#AUTHENTICATION__REFRESH_TOKEN__WEB_ADMIN_EXPIRATION=
+# Shorter token lifetimes (minutes) for web/admin clients (default 15 / 30 in code).
+# Mobile and unknown/legacy clients always use the EXPIRATION values above. Override here
+# per environment if needed.
+#AUTHENTICATION__ACCESS_TOKEN__WEB_ADMIN_EXPIRATION=15
+#AUTHENTICATION__REFRESH_TOKEN__WEB_ADMIN_EXPIRATION=30
 AUTHENTICATION__ALGORITHM="HS256"
 AUTHENTICATION__TOKEN_TYPE="Bearer"
 AUTHENTICATION__PASSWORD_RECOVER__EXPIRATION=900

src/apps/authentication/tests/test_auth.py

@@ -415,21 +415,9 @@ def _decode_tokens(result: dict) -> tuple[dict, dict]:
         return access_payload, refresh_payload
 
     @staticmethod
-    def _assert_lifetimes_unchanged(
-        access_payload: dict, refresh_payload: dict, before: datetime.datetime, after: datetime.datetime
-    ):
-        access_delta = datetime.timedelta(minutes=settings.authentication.access_token.expiration)
-        refresh_delta = datetime.timedelta(minutes=settings.authentication.refresh_token.expiration)
-        assert (
-            int((before + access_delta).timestamp())
-            <= access_payload["exp"]
-            <= int((after + access_delta).timestamp()) + 1
-        )
-        assert (
-            int((before + refresh_delta).timestamp())
-            <= refresh_payload["exp"]
-            <= int((after + refresh_delta).timestamp()) + 1
-        )
+    def _assert_expires_in(exp: int, minutes: int, before: datetime.datetime, after: datetime.datetime):
+        delta = datetime.timedelta(minutes=minutes)
+        assert int((before + delta).timestamp()) <= exp <= int((after + delta).timestamp()) + 1
 
     @pytest.mark.parametrize("content_source", ("web", "admin", "mobile"))
     async def test_login_embeds_client_claim(self, client: TestClient, user: User, content_source: str):
@@ -444,7 +432,16 @@ async def test_login_embeds_client_claim(self, client: TestClient, user: User, c
         access_payload, refresh_payload = self._decode_tokens(resp.json()["result"])
         assert access_payload["client"] == content_source
         assert refresh_payload["client"] == content_source
-        self._assert_lifetimes_unchanged(access_payload, refresh_payload, before, after)
+        # web/admin get the short lifetimes; mobile keeps the defaults.
+        if content_source in ("web", "admin"):
+            expected_access = settings.authentication.access_token.web_admin_expiration
+            expected_refresh = settings.authentication.refresh_token.web_admin_expiration
+            assert expected_access is not None and expected_refresh is not None
+        else:
+            expected_access = settings.authentication.access_token.expiration
+            expected_refresh = settings.authentication.refresh_token.expiration
+        self._assert_expires_in(access_payload["exp"], expected_access, before, after)
+        self._assert_expires_in(refresh_payload["exp"], expected_refresh, before, after)
 
     async def test_login_audit_event_records_client_source(self, client: TestClient, user: User, mocker: MockerFixture):
         audit_log = mocker.patch("apps.authentication.api.auth.log")
@@ -504,7 +501,9 @@ async def test_login_without_client_claim(self, client: TestClient, user: User,
         access_payload, refresh_payload = self._decode_tokens(resp.json()["result"])
         assert "client" not in access_payload
         assert "client" not in refresh_payload
-        self._assert_lifetimes_unchanged(access_payload, refresh_payload, before, after)
+        # No client claim -> default (mobile) lifetimes.
+        self._assert_expires_in(access_payload["exp"], settings.authentication.access_token.expiration, before, after)
+        self._assert_expires_in(refresh_payload["exp"], settings.authentication.refresh_token.expiration, before, after)
 
 
 class TestShortLivedWebAdminTokens(BaseTest):

src/config/authentication.py

@@ -7,9 +7,9 @@ class AccessTokenSettings(BaseModel):
     secret_key: str
     # Set in minutes
     expiration: int = 30
-    # Shorter lifetime (minutes) for web/admin clients. None = same as `expiration`
-    # (feature off). See AuthenticationService.token_expiration_minutes.
-    web_admin_expiration: int | None = None
+    # Shorter lifetime (minutes) for web/admin clients. None = same as `expiration`.
+    # See AuthenticationService.token_expiration_minutes.
+    web_admin_expiration: int | None = 15
 
     @field_validator("secret_key")
     @classmethod
@@ -23,9 +23,9 @@ class RefreshTokenSettings(BaseModel):
     secret_key: str
     # Set in minutes
     expiration: int = 540
-    # Shorter lifetime (minutes) for web/admin clients. None = same as `expiration`
-    # (feature off). See AuthenticationService.token_expiration_minutes.
-    web_admin_expiration: int | None = None
+    # Shorter lifetime (minutes) for web/admin clients. None = same as `expiration`.
+    # See AuthenticationService.token_expiration_minutes.
+    web_admin_expiration: int | None = 30
 
     transition_key: str | None = None
     transition_expire_date: datetime.date | None = None