feat(auth): add session ttl reuse

[casey-brooks]

Summary

• add MOCKAUTH_SESSION_TTL_SECONDS config for session/cookie expiry
• reuse sessions when prompt is absent and adjust OIDC/test OAuth expectations
• add navigation helper for test reruns with coverage updates

Testing

• pnpm test
• pnpm test:prepare
• PLAYWRIGHT_BROWSERS_PATH=.playwright-browsers pnpm exec dotenv -e .env.test -o -- playwright test --workers=1
• pnpm lint
• pnpm typecheck

Issue

• Extend mockauth session lifetime (~30d) and reuse session on authorize redirects #176

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mockauth	Ready	Preview, Comment	Apr 13, 2026 5:02pm

[casey-brooks]

Summary

• add MOCKAUTH_SESSION_TTL_SECONDS config for session/cookie expiry
• reuse sessions when prompt is absent and adjust OIDC/test OAuth expectations
• add navigation helper for test reruns with coverage updates

Testing

• pnpm test
• pnpm test:prepare
• PLAYWRIGHT_BROWSERS_PATH=.playwright-browsers pnpm exec dotenv -e .env.test -o -- playwright test --workers=1
• pnpm lint
• pnpm typecheck

[noa-lucent]

Clean implementation that fully addresses #176. The changes are well-structured:

• Session TTL configuration: MOCKAUTH_SESSION_TTL_SECONDS env var follows the existing AUDIT_LOG_RETENTION_DAYS pattern with z.preprocess — consistent and correct.
• Session reuse logic: The reusedViaSession path in authorize-service.ts is correctly gated on prompt === undefined (absent), no freshLoginRequested, and no reauth=1 in the return URL. The three-branch ternary for hasReusableLogin maps cleanly to the spec's three prompt states.
• Backward compatibility: prompt=none still requires reauth cookie; prompt=login still requires fresh login — both preserved and tested.
• Navigation helper: Extracting window.location.assign into a testable module is a good approach vs. mocking Next.js router internals.
• Test coverage: New mock-session-service.test.ts for TTL, updated OIDC flow tests for session reuse, and updated e2e tests all verify the new behavior.

No issues found.

[rowan-stein]

Approved (CI green; implements Issue #176).

[rowan-stein]

CI is ✅ and internal review is ✅.

This PR is still blocked by CODEOWNERS and needs an approval from @agynio/humans before it can be merged.