fix(session): raise the default refresh_token_ttl from 1h to 1d

[Bccorb]

Problem

refresh_token_ttl falls back to '1h' when system_config and REFRESH_TOKEN_TTL are both unset:

• src/services/sessionIssuance.ts:72
• src/controllers/authentication.ts:405

A one hour refresh token caps the total session at one hour regardless of user activity. A 15 minute access token is fine on its own, because it is meant to be refreshed, but once the refresh token expires the session cannot be recovered and the user is signed out mid task.

This is a bad default rather than a considered security decision, and it is inherited silently by every self hosted deployment and every future managed instance that does not explicitly set REFRESH_TOKEN_TTL.

Observed impact

Hit in production on Seamless Review Board. Reviewers work through long review forms that hold state locally and make no API calls while being filled in. Nothing triggers a refresh during that time, so:

1. Sign in issues a 15 minute access token and a 1 hour refresh token.
2. The reviewer spends two or more hours on the review, generating no API traffic.
3. The access token expires at 15 minutes, the refresh token at 60.
4. The first save attempt returns 401 and the work is lost.

Long form applications are exactly the case this default breaks.

Proposed change

Change the fallback from '1h' to '1d' in both call sites. Refresh tokens are already rotated on use (replacedBySessionId) and stored hashed in the sessions table, so a longer lived rotating token is consistent with the existing model.

Notes

• Touches the token path, so run /security-review before calling it done.
• The response refreshTtl field is part of the wire contract. Confirm whether the SDKs treat the value as advisory or bind behavior to it before release, and check the ecosystem map for blast radius.
• Needs a changeset. This changes runtime behavior for anyone relying on the fallback, so it is worth calling out explicitly in the changelog.
• Follow up worth considering separately: the React SDK has no scheduled refresh, it only refreshes on provider mount and on explicit calls. A longer TTL reduces the blast radius but does not remove the underlying gap for very long sessions.