Make invitation token lifespan configurable

[Leinad4Mind]

Idea Description

Currently, user invitation links appear to expire after a relatively short period, likely using the default ASP.NET Identity TokenLifespan. When an invitation expires, opening the link returns a generic HTTP 400 error, and an administrator must resend the invitation.

It would be useful to make the invitation token lifespan configurable in Kavita’s Server Settings, for example, allowing administrators to choose 24 hours, 3 days, 7 days, 14 days, or a custom duration.

This would be particularly helpful for private or community instances where invited users may not open the email immediately.

Suggested implementation:

• Add an Invitation link lifespan setting to Server Settings.
• Use the configured value for the relevant ASP.NET Identity TokenLifespan.
• Display the expiration period in the invitation email.
• Show a clear “This invitation has expired” message instead of a generic HTTP 400 error.
• Keep resending an invitation as the method for generating a new token and invalidating the previous one.

A default of 24 hours could be retained to preserve the current security behaviour.

Idea Category

API

Duration of Using Kavita

1 month

Before submitting

• I've already searched for existing ideas before posting.