fix: harden login session lifetime

internal/auth/auth.go

@@ -197,16 +197,24 @@ type jwtClaims struct {
 	jwt.StandardClaims
 }
 
-func NewToken(username string, _ int) (string, error) {
-	// CHFS v4 keeps the JWT itself valid for one year. session.timeout is
-	// retained as a compatibility configuration field, but it does not alter
-	// the JWT exp claim in the original implementation.
-	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(365 * 24 * time.Hour).Unix()}}
+func NewToken(username string, timeoutMinutes int, secrets ...string) (string, error) {
+	if timeoutMinutes <= 0 {
+		timeoutMinutes = 30
+	}
+	secret := jwtSecret
+	if len(secrets) > 0 && secrets[0] != "" {
+		secret = secrets[0]
+	}
+	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(time.Duration(timeoutMinutes) * time.Minute).Unix()}}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
-	return token.SignedString([]byte(jwtSecret))
+	return token.SignedString([]byte(secret))
 }
 
-func GetAccFromToken(raw string) (string, error) {
+func GetAccFromToken(raw string, secrets ...string) (string, error) {
+	secret := jwtSecret
+	if len(secrets) > 0 && secrets[0] != "" {
+		secret = secrets[0]
+	}
 	if raw == "" {
 		return "", fmt.Errorf("empty token")
 	}
@@ -215,7 +223,7 @@ func GetAccFromToken(raw string) (string, error) {
 		if t.Method != jwt.SigningMethodHS256 {
 			return nil, fmt.Errorf("unexpected signing method: %s", t.Method.Alg())
 		}
-		return []byte(jwtSecret), nil
+		return []byte(secret), nil
 	})
 	if err != nil || token == nil || !token.Valid {
 		if err == nil {