fix: expire initial jwt based on session creation time

Author: staaldraad

internal/tokens/service.go

@@ -676,7 +676,7 @@ func (s *Service) GenerateAccessToken(r *http.Request, tx *storage.Connection, p
 		// if user has mfa enabled and the session has not yet been upgraded
 		// and Limit duration of AAL1 sessions is enabled
 		// expiresAt should be set to the maximum duration for low aal sessions
-		expiresAt = issuedAt.Add(*config.Sessions.AllowLowAAL)
+		expiresAt = session.CreatedAt.UTC().Add(*config.Sessions.AllowLowAAL)
 	} else {
 		expiresAt = issuedAt.Add(time.Second * time.Duration(config.JWT.Exp))
 	}

internal/tokens/service_test.go

@@ -1237,7 +1237,7 @@ func TestGenerateAccessTokenAllowLowAAL(t *testing.T) {
 			AuthenticationMethod: models.PasswordGrant,
 		})
 		require.NoError(t, err)
-		require.Equal(t, now.Add(allowLowAAL).Unix(), expiresAt)
+		require.Equal(t, session.CreatedAt.UTC().Add(allowLowAAL).Unix(), expiresAt)
 	})
 
 	t.Run("AAL2 session for MFA user uses standard JWT expiry", func(t *testing.T) {