From 75d6e450805d6a2201ff0ee8068941a680b13dd2 Mon Sep 17 00:00:00 2001
From: OpenClaw Agent <openclaw@example.com>
Date: Mon, 21 Sep 2026 19:55:28 +0800
Subject: [PATCH] fix: enforce configured session timeout

---
 chfs-ng/internal/api/server.go | 8 ++++++--
 chfs-ng/internal/auth/auth.go  | 9 ++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/chfs-ng/internal/api/server.go b/chfs-ng/internal/api/server.go
index 05bc527..eabfa87 100644
--- a/chfs-ng/internal/api/server.go
+++ b/chfs-ng/internal/api/server.go
@@ -339,12 +339,16 @@ func (s *Server) session(w http.ResponseWriter, r *http.Request) {
 		writeJSONError(w, http.StatusNotFound, "user or password is wrong")
 		return
 	}
-	token, err := auth.NewToken(a.Username)
+	ttl := 365 * 24 * time.Hour
+	if s.SessionTimeout > 0 {
+		ttl = time.Duration(s.SessionTimeout) * time.Minute
+	}
+	token, err := auth.NewTokenWithTTL(a.Username, ttl)
 	if err != nil {
 		writeJSONError(w, http.StatusInternalServerError, "failed to create token")
 		return
 	}
-	expires := time.Now().Add(365 * 24 * time.Hour)
+	expires := time.Now().Add(ttl)
 	http.SetCookie(w, &http.Cookie{Name: "JWT", Value: token, Path: "/", Expires: expires, HttpOnly: true})
 	http.SetCookie(w, &http.Cookie{Name: "user", Value: a.Username, Path: "/", Expires: expires})
 	w.WriteHeader(http.StatusCreated)
diff --git a/chfs-ng/internal/auth/auth.go b/chfs-ng/internal/auth/auth.go
index 4c7ea8b..4d6ed55 100644
--- a/chfs-ng/internal/auth/auth.go
+++ b/chfs-ng/internal/auth/auth.go
@@ -187,7 +187,14 @@ type jwtClaims struct {
 }
 
 func NewToken(username string) (string, error) {
-	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(365 * 24 * time.Hour).Unix()}}
+	return NewTokenWithTTL(username, 365*24*time.Hour)
+}
+
+func NewTokenWithTTL(username string, ttl time.Duration) (string, error) {
+	if ttl <= 0 {
+		return "", fmt.Errorf("invalid token ttl")
+	}
+	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(ttl).Unix()}}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	return token.SignedString([]byte(jwtSecret))
 }