long auth0 tokens on fixed token clusters (#3042)

Signed-off-by: Itai Segall <itai.segall@digitalasset.com>

Author: isegall-da

cluster/expected/infra/expected.json

@@ -37,7 +37,8 @@
     "inputs": {
       "allowOfflineAccess": true,
       "identifier": "https://ledger_api.sv-1.test-stack.canton.network",
-      "name": "Ledger API for SV sv-1 on test-stack (Pulumi managed)"
+      "name": "Ledger API for SV sv-1 on test-stack (Pulumi managed)",
+      "tokenLifetime": 86400
     },
     "name": "LedgerApisv1",
     "provider": "urn:pulumi:test-stack::test-project::pulumi:providers:auth0::dev::undefined_id",
@@ -49,7 +50,8 @@
     "inputs": {
       "allowOfflineAccess": true,
       "identifier": "https://ledger_api.sv-da-1.test-stack.canton.network",
-      "name": "Ledger API for SV sv-da-1 on test-stack (Pulumi managed)"
+      "name": "Ledger API for SV sv-da-1 on test-stack (Pulumi managed)",
+      "tokenLifetime": 86400
     },
     "name": "LedgerApisvda1",
     "provider": "urn:pulumi:test-stack::test-project::pulumi:providers:auth0::dev::undefined_id",
@@ -117,7 +119,8 @@
     "inputs": {
       "allowOfflineAccess": true,
       "identifier": "https://sv.sv-1.test-stack.canton.network/api",
-      "name": "SV App API for SV sv-1 on test-stack (Pulumi managed)"
+      "name": "SV App API for SV sv-1 on test-stack (Pulumi managed)",
+      "tokenLifetime": 86400
     },
     "name": "SvAppApisv1",
     "provider": "urn:pulumi:test-stack::test-project::pulumi:providers:auth0::dev::undefined_id",
@@ -129,7 +132,8 @@
     "inputs": {
       "allowOfflineAccess": true,
       "identifier": "https://sv.sv-da-1.test-stack.canton.network/api",
-      "name": "SV App API for SV sv-da-1 on test-stack (Pulumi managed)"
+      "name": "SV App API for SV sv-da-1 on test-stack (Pulumi managed)",
+      "tokenLifetime": 86400
     },
     "name": "SvAppApisvda1",
     "provider": "urn:pulumi:test-stack::test-project::pulumi:providers:auth0::dev::undefined_id",
@@ -261,7 +265,8 @@
     "inputs": {
       "allowOfflineAccess": true,
       "identifier": "https://validator.sv-1.test-stack.canton.network/api",
-      "name": "Validator App API for SV sv-1 on test-stack (Pulumi managed)"
+      "name": "Validator App API for SV sv-1 on test-stack (Pulumi managed)",
+      "tokenLifetime": 86400
     },
     "name": "ValidatorAppApisv1",
     "provider": "urn:pulumi:test-stack::test-project::pulumi:providers:auth0::dev::undefined_id",
@@ -273,7 +278,8 @@
     "inputs": {
       "allowOfflineAccess": true,
       "identifier": "https://validator.sv-da-1.test-stack.canton.network/api",
-      "name": "Validator App API for SV sv-da-1 on test-stack (Pulumi managed)"
+      "name": "Validator App API for SV sv-da-1 on test-stack (Pulumi managed)",
+      "tokenLifetime": 86400
     },
     "name": "ValidatorAppApisvda1",
     "provider": "urn:pulumi:test-stack::test-project::pulumi:providers:auth0::dev::undefined_id",

cluster/pulumi/infra/src/auth0.ts

@@ -12,13 +12,18 @@ import {
   Auth0NamespaceConfig,
   DEFAULT_AUDIENCE,
   NamespacedAuth0Configs,
+  fixedTokens,
 } from '@lfdecentralizedtrust/splice-pulumi-common';
 import {
   standardSvConfigs,
   extraSvConfigs,
   dsoSize,
 } from '@lfdecentralizedtrust/splice-pulumi-common-sv';
 
+function tokenLifetime(): number {
+  return fixedTokens() ? 2592000 : 86400; // TODO(DACH-NY/canton-network-internal#2114): Move this to the cluster config? We want it to be long for fixed token clusters
+}
+
 function ledgerApiAudience(
   svNamespace: string,
   clusterBasename: string,
@@ -36,6 +41,7 @@ function ledgerApiAudience(
         name: `Ledger API for SV ${svNamespace} on ${clusterBasename} (Pulumi managed)`,
         identifier: `https://ledger_api.${svNamespace}.${clusterBasename}.canton.network`,
         allowOfflineAccess: true, // TODO(DACH-NY/canton-network-internal#2114): is this still needed?
+        tokenLifetime: tokenLifetime(),
       },
       { provider: auth0DomainProvider }
     );
@@ -78,6 +84,7 @@ function svAppAudience(
         name: `SV App API for SV ${svNamespace} on ${clusterBasename} (Pulumi managed)`,
         identifier: `https://sv.${svNamespace}.${clusterBasename}.canton.network/api`,
         allowOfflineAccess: true, // TODO(DACH-NY/canton-network-internal#2114): is this still needed?
+        tokenLifetime: tokenLifetime(),
       },
       { provider: auth0DomainProvider }
     );
@@ -106,6 +113,7 @@ function validatorAppAudience(
         name: `Validator App API for SV ${svNamespace} on ${clusterBasename} (Pulumi managed)`,
         identifier: `https://validator.${svNamespace}.${clusterBasename}.canton.network/api`,
         allowOfflineAccess: true, // TODO(DACH-NY/canton-network-internal#2114): is this still needed?
+        tokenLifetime: tokenLifetime(),
       },
       { provider: auth0DomainProvider }
     );