fusion44 dccaa17a8e fix(auth): correct JWT expiry unit and use standard exp claim ... sign_jwt added JWT_EXPIRY_TIME (seconds) to a milliseconds epoch and stored it in a custom 'expires' claim, while register_cookie_updater slept JWT_EXPIRY_TIME as seconds. With the code default (300) tokens effectively expired almost immediately; with the sampled 3600000 the cookie-refresh loop slept ~41 days, so the local .cookie held an expired token nearly always. The custom claim also meant PyJWT never validated expiry itself. - issue standard 'iat'/'exp' claims (seconds) and let PyJWT validate, requiring 'exp' on decode - derive the cookie refresh interval from the same unit, guarded against tiny/negative values - default BAPI_JWT_EXPIRY_TIME to 3600s and fix .env_sample (was 3600000 'milliseconds') Existing tokens and the local .cookie are invalidated by this change; clients re-login and the cookie regenerates at startup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-03 20:35:34 +02:00
..
models	feat: implement Ruff as a linter; fix given errors	2023-06-25 07:17:00 +02:00
routers	tests: add better integration tests	2026-02-03 11:06:06 +01:00
__init__.py	test: Add testing dependencies and first tests	2021-10-02 12:00:44 +02:00
test_app_manage_lock.py	fix(apps): don't release another task's app-manage lock	2026-07-03 20:01:54 +02:00
test_cln_shell_safety.py	fix(lightning): prevent shell injection in CLN local calls	2026-07-03 19:58:41 +02:00
test_exec_bash_timeout.py	fix(api): catch subprocess timeouts in exec_bash_command	2026-07-03 19:59:57 +02:00
test_jwt.py	fix(auth): correct JWT expiry unit and use standard exp claim	2026-07-03 20:35:34 +02:00
test_warmup_events.py	fix: send bitcoin-only warmup app status as app_state_update_message	2026-07-03 15:30:17 +02:00
utils.py	chore: format source using the pre_commit command	2022-03-20 17:20:56 +01:00