fix: harden login session lifetime

internal/auth/auth_test.go

@@ -1,6 +1,33 @@
 package auth
 
-import "testing"
+import (
+	"testing"
+	"time"
+
+	jwt "github.com/golang-jwt/jwt/v4"
+)
+
+func TestTokenUsesConfiguredSecretAndTimeout(t *testing.T) {
+	const secret = "test-secret"
+	before := time.Now().Add(2 * time.Minute).Unix()
+	raw, err := NewToken("alice", 2, secret)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var claims jwtClaims
+	token, err := jwt.ParseWithClaims(raw, &claims, func(t *jwt.Token) (interface{}, error) {
+		return []byte(secret), nil
+	})
+	if err != nil || !token.Valid {
+		t.Fatalf("token should validate with configured secret: %v", err)
+	}
+	if claims.ExpiresAt < before-1 || claims.ExpiresAt > before+1 {
+		t.Fatalf("unexpected expiration: %v", claims.ExpiresAt)
+	}
+	if _, err := GetAccFromToken(raw, "wrong-secret"); err == nil {
+		t.Fatal("token validated with wrong secret")
+	}
+}
 
 func TestMatchPath(t *testing.T) {
 	cases := []struct {