fix: enforce configured session timeout

chfs-ng/internal/api/server.go

@@ -339,12 +339,16 @@ func (s *Server) session(w http.ResponseWriter, r *http.Request) {
 		writeJSONError(w, http.StatusNotFound, "user or password is wrong")
 		return
 	}
-	token, err := auth.NewToken(a.Username)
+	ttl := 365 * 24 * time.Hour
+	if s.SessionTimeout > 0 {
+		ttl = time.Duration(s.SessionTimeout) * time.Minute
+	}
+	token, err := auth.NewTokenWithTTL(a.Username, ttl)
 	if err != nil {
 		writeJSONError(w, http.StatusInternalServerError, "failed to create token")
 		return
 	}
-	expires := time.Now().Add(365 * 24 * time.Hour)
+	expires := time.Now().Add(ttl)
 	http.SetCookie(w, &http.Cookie{Name: "JWT", Value: token, Path: "/", Expires: expires, HttpOnly: true})
 	http.SetCookie(w, &http.Cookie{Name: "user", Value: a.Username, Path: "/", Expires: expires})
 	w.WriteHeader(http.StatusCreated)

chfs-ng/internal/auth/auth.go

@@ -187,7 +187,14 @@ type jwtClaims struct {
 }
 
 func NewToken(username string) (string, error) {
-	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(365 * 24 * time.Hour).Unix()}}
+	return NewTokenWithTTL(username, 365*24*time.Hour)
+}
+
+func NewTokenWithTTL(username string, ttl time.Duration) (string, error) {
+	if ttl <= 0 {
+		return "", fmt.Errorf("invalid token ttl")
+	}
+	claims := jwtClaims{Acc: username, StandardClaims: jwt.StandardClaims{ExpiresAt: time.Now().Add(ttl).Unix()}}
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	return token.SignedString([]byte(jwtSecret))
 }