fix(auth): bind accessToken cookie + JWT to a 7-day TTL

[awais786]

Re-opening the previously merged & reverted change (#13 / #16). Same commit ad431a19a, unchanged.

Summary

Outline's accessToken cookie was hardcoded to 3 months (addMonths(new Date(), 3)) at three call sites — outliving the rest of the foss-server-bundle's 7-day session window. After a stack-wide session expiry users would stay signed in to Outline alone.

Additionally, the /auth/redirect handler was minting JWTs with no expiresAt claim (getJwtToken(undefined, service)), making the token replayable indefinitely if it ever left the cookie. The validator at server/utils/jwt.ts:47 silently skips the expiry check when the claim is missing.

Changes

• Export JWT_COOKIE_TTL_DAYS = 7 from server/utils/authentication.ts as a single source of truth (with rationale in a docstring).
• Use addDays(new Date(), JWT_COOKIE_TTL_DAYS) at all three mint sites:
  • server/middlewares/authentication.ts (FORWARDAUTH login)
  • server/routes/auth/index.ts (/auth/redirect)
  • server/utils/authentication.ts (signIn callback)
• Fix /auth/redirect to pass expires into both getJwtToken and the cookie option, so the JWT and cookie die together. Matches the pattern the other two paths already use.
• Replace the legacy jwtToken === ctx.state.auth.token heuristic at /auth/redirect (which relied on session JWTs being deterministic — no longer true after the expiresAt fix) with an explicit type check: getJWTPayload(ctx.state.auth.token).type !== "transfer". Direct, intent-revealing.

Tests

• server/middlewares/authentication.test.ts — asserts the FORWARDAUTH accessToken cookie's expires is ~now + JWT_COOKIE_TTL_DAYS (±60s skew).
• server/routes/auth/index.test.ts — asserts /auth/redirect mints a JWT whose expiresAt claim is set and ~now + JWT_COOKIE_TTL_DAYS (±60s skew). JWT payload decoded with spec-correct base64url.
• Existing should prevent token extension by rejecting JWT tokens test still passes via the new type check.

Future

If deployment-specific control becomes needed, lift JWT_COOKIE_TTL_DAYS to an env var (e.g. SESSION_TTL_SECONDS).