fusion44 dccaa17a8e fix(auth): correct JWT expiry unit and use standard exp claim ... sign_jwt added JWT_EXPIRY_TIME (seconds) to a milliseconds epoch and stored it in a custom 'expires' claim, while register_cookie_updater slept JWT_EXPIRY_TIME as seconds. With the code default (300) tokens effectively expired almost immediately; with the sampled 3600000 the cookie-refresh loop slept ~41 days, so the local .cookie held an expired token nearly always. The custom claim also meant PyJWT never validated expiry itself. - issue standard 'iat'/'exp' claims (seconds) and let PyJWT validate, requiring 'exp' on decode - derive the cookie refresh interval from the same unit, guarded against tiny/negative values - default BAPI_JWT_EXPIRY_TIME to 3600s and fix .env_sample (was 3600000 'milliseconds') Existing tokens and the local .cookie are invalidated by this change; clients re-login and the cookie regenerates at startup. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		2026-07-03 20:35:34 +02:00
..
__init__.py	feat: implement get hardware info api	2021-06-12 15:07:35 +02:00
auth_bearer.py	feat: implement Ruff as a linter; fix given errors	2023-06-25 07:17:00 +02:00
auth_handler.py	fix(auth): correct JWT expiry unit and use standard exp claim	2026-07-03 20:35:34 +02:00