Auth: JWT expires after 1 day with no refresh path — users forced to re-login daily

[lane711]

Problem

The OTP auth plugin issues JWTs with a fixed ~1 day (86400s) exp claim, and there's no working refresh path. Apps consuming SonicJS auth see users logged out every 24h even when their session cookie is set for 30 days, because the JWT inside the cookie expires long before the cookie does.

Observed in @sonicjs-cms/core@2.16.0.

Repro

1. Log in via /auth/otp/verify
2. Decode the returned JWT — exp is ~24h out
3. Wait >24h (or fast-forward clock)
4. Any authed request 401s; user is forced through OTP again

Expected

• JWT TTL is configurable (env var, e.g. JWT_EXPIRES_IN, or plugin option)
• A real /auth/refresh endpoint that re-signs and returns a new token (sliding session), so a long-lived cookie can keep a user logged in until they explicitly log out

Proposed fix

1. Configurable TTL — read JWT_EXPIRES_IN (or equivalent plugin option) and pass it to the signer. Sensible default of 30 days.
2. Working refresh endpoint — POST /auth/refresh accepts a still-valid (or recently-expired within a grace window) token, validates the user, and issues a fresh token with a new exp.
3. Document both in the auth plugin README.

Happy to PR — wanted to track the bug first.

Context

• Web app side: verify-token middleware checks payload.exp and rejects, so the 30-day session cookie is moot once the JWT inside dies.
• App-side /api/auth/refresh only re-validates the existing token (can't extend it without SonicJS support).