fix(auth): expire login OTP codes after the advertised 10 minutes

apps/web/__tests__/unit/auth-options.test.ts

@@ -39,4 +39,17 @@ describe("authOptions", () => {
 
 		expect(providers).not.toContain("apple");
 	});
+
+	// Without an explicit maxAge next-auth falls back to 24 hours, which is far
+	// too long for a 6-digit code and contradicts what the OTP email tells users.
+	it("expires email verification codes after the advertised 10 minutes", () => {
+		const email = authOptions().providers.find(
+			(provider) => provider.id === "email",
+		);
+
+		expect(email).toBeDefined();
+		expect((email as { options?: { maxAge?: number } }).options?.maxAge).toBe(
+			10 * 60,
+		);
+	});
 });

packages/database/auth/auth-options.ts

@@ -19,6 +19,8 @@ import { DrizzleAdapter } from "./drizzle-adapter.ts";
 
 export const maxDuration = 120;
 
+const OTP_CODE_MAX_AGE_SECONDS = 10 * 60;
+
 export async function decodeSessionToken(
 	params: JWTDecodeParams,
 ): Promise<JWT | null> {
@@ -108,6 +110,11 @@ export const authOptions = (): NextAuthOptions => {
 					},
 				}),
 				EmailProvider({
+					// next-auth defaults to 24h, but the code is 6 digits and the
+					// verify path has no attempt limiting, so a day-long window is a
+					// practical brute-force target. The OTP email and the dev console
+					// have always told users 10 minutes; this makes that true.
+					maxAge: OTP_CODE_MAX_AGE_SECONDS,
 					async generateVerificationToken() {
 						return crypto.randomInt(100000, 1000000).toString();
 					},
@@ -123,7 +130,9 @@ export const authOptions = (): NextAuthOptions => {
 							);
 							console.log(`📧 Email: ${identifier}`);
 							console.log(`🔢 Code: ${token}`);
-							console.log(`⏱  Expires in: 10 minutes`);
+							console.log(
+								`⏱  Expires in: ${OTP_CODE_MAX_AGE_SECONDS / 60} minutes`,
+							);
 							console.log(
 								"━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━",
 							);