Enrollment email always displays default token and session validity values

[Tharguard]

Enrollment email always displays default token and session validity values

Description

In Defguard 2.0.3 stable, the enrollment email always displays the default validity values:

• Enrollment token validity: 24 hours
• Enrollment session validity: 10 minutes

This happens even when different values are configured for the enrollment token timeout and enrollment session timeout.

The configured values appear to be applied correctly to the actual enrollment process, but the text shown in the email remains unchanged.

Environment

• Defguard version: 2.0.3 stable
• Installation type: Native package installation
• Database: PostgreSQL
• Configuration file: /etc/defguard/core.conf

Configuration

For example:

DEFGUARD_ENROLLMENT_TOKEN_TIMEOUT=1w
DEFGUARD_ENROLLMENT_SESSION_TIMEOUT=30m

The Defguard Core service was restarted after changing the configuration, and a new enrollment token and email were generated afterward.

Steps to reproduce

1. Install or upgrade to Defguard 2.0.3 stable.

2. Configure non-default enrollment timeout values, for example:

   DEFGUARD_ENROLLMENT_TOKEN_TIMEOUT=1w
   DEFGUARD_ENROLLMENT_SESSION_TIMEOUT=30m

3. Restart the Defguard Core service.

4. Start a new enrollment for a user.

5. Send the enrollment notification email.

6. Open the generated enrollment email.

Actual result

The enrollment email still displays:

The token is valid for 24 hours. Once the enrollment process starts, you have 10 minutes to complete it.

The text does not reflect the configured timeout values.

Expected result

The enrollment email should display the actual configured values, for example:

The token is valid for 1 week. Once the enrollment process starts, you have 30 minutes to complete it.

Alternatively, the email template should expose variables for both values, such as:

{{ enrollment_token_timeout }}
{{ enrollment_session_timeout }}

Additional information

The email appears to use a static token_info text from the mail context instead of values derived from the current Defguard configuration or from the generated enrollment token.

Manually changing the token_info entry in the mail_context database table can correct the displayed text, but this is only a static workaround. It does not automatically follow future configuration changes and may also be overwritten by migrations or updates.

The actual enrollment token expiration and the displayed expiration text should use the same source of truth.

Suggested fix

When generating the enrollment email:

1. Pass the effective token expiration duration to the email template.
2. Pass the effective enrollment session duration to the email template.
3. Render both values dynamically instead of using a static token_info string.
4. Ensure that a per-enrollment API override, such as token_expiration_time, is also reflected in the generated email.

Impact

Users receive incorrect information about how long their enrollment token and enrollment session remain valid. This can lead to confusion, unnecessary support requests, and users assuming that a valid token has already expired.
Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

Version information

• Defguard Core version: vX.Y.Z
• Defguard Gateway version: vX.Y.Z (if bug is applicable to VPN functionality)
  • Operating system and version running the gateway: Debian X/Ubuntu Y/...
• Your browser and version [e.g. chrome 99, safari]

Screenshots
If applicable, add screenshots to help explain your problem.

Additional context
Add any other context about the problem here.