Merge pull request #134 from trakrf/worktree-miks2u+tra-843-preview-jwt-ttl-900

feat(trakrf-backend): per-env JWT access-token TTL → 900 (preview + prod) (TRA-843)

Author: mikestankavich

argocd/root/templates/trakrf-backend.yaml

@@ -15,6 +15,12 @@
 */ -}}
 {{- range $env, $cfg := $.Values.envs }}
 {{- $base := printf "database:\n  name: trakrf\n  user: trakrf-app\n  credentialsSecret: trakrf-app-credentials\n  host: %s\nmigrate:\n  database: trakrf\n  user: trakrf-migrate\n  credentialsSecret: trakrf-migrate-credentials\n  host: %s\nconfig:\n  appEnv: %s\n  environmentLabel: %q\n" $cfg.dbHost $cfg.dbHost $env $cfg.environmentLabel }}
+{{- /* Per-env access-token TTL (TRA-843). Appended to the config block BEFORE
+       the top-level image: key below. Empty falls back to the chart default in
+       helm/trakrf-backend/values.yaml ("3600"). */ -}}
+{{- if $cfg.jwtExpirationSeconds }}
+{{- $base = printf "%s  jwtExpirationSeconds: %q\n" $base $cfg.jwtExpirationSeconds }}
+{{- end }}
 {{- if $cfg.imageTag }}
 {{- $base = printf "%simage:\n  tag: %q\n" $base $cfg.imageTag }}
 {{- end }}

argocd/root/values.yaml

@@ -41,6 +41,16 @@ namespaces:
 #                                index.html. Empty / "prod" / "production" → no
 #                                banner. Same main image everywhere; the banner is
 #                                purely this runtime value.
+# jwtExpirationSeconds         — access-token TTL (seconds) → backend JWT_EXPIRATION
+#                                (TRA-843). Per-env so the short-TTL half of the
+#                                refresh design can land on preview ahead of prod.
+#                                Empty falls back to the chart default
+#                                (helm/trakrf-backend/values.yaml: "3600").
+#                                preview="900" (refresh live + soaked). prod also
+#                                "900" (Mike's call, 2026-05-30 cutover) — assumes
+#                                PR #416's refresh endpoint is on the :prod image;
+#                                if not, prod users hit 15-min re-logins. Takes
+#                                effect only on the next apply-root-app.sh.
 # dbCluster.enabled            — false skips emitting the CNPG Cluster
 #                                Application entirely.
 # dbCluster.fullnameOverride   — drives CNPG Cluster name + Argo App name.
@@ -57,6 +67,7 @@ envs:
     mqttIp: ""
     imageTag: ""
     environmentLabel: preview
+    jwtExpirationSeconds: "900"
     dbCluster:
       enabled: true
       fullnameOverride: trakrf-db-preview
@@ -74,6 +85,11 @@ envs:
     # window; it flips to empty (no banner) as part of the Saturday cutover.
     imageTag: prod
     environmentLabel: GKE pre-prod
+    # TRA-843: prod short-TTL realized here too (Mike's call, 2026-05-30 cutover
+    # window). Assumes the refresh endpoint (PR #416) is on the :prod image —
+    # otherwise prod users hit 15-min re-logins with no refresh. Takes effect on
+    # the next scripts/apply-root-app.sh against the live cluster.
+    jwtExpirationSeconds: "900"
     dbCluster:
       enabled: true
       fullnameOverride: trakrf-db-prod