fix: update refresh token TTL to 7 days (#1585)

* fix: update refresh token TTL to 30 days

* feat: add refresh token TTL config and reduce ttl

Author: nnnkkk7

pkg/auth/api/api.go

@@ -60,7 +60,7 @@ type options struct {
 }
 
 var defaultOptions = options{
-	refreshTokenTTL: time.Hour,
+	refreshTokenTTL: 7 * 24 * time.Hour,
 	logger:          zap.NewNop(),
 }
 

pkg/web/cmd/server/server.go

@@ -126,6 +126,7 @@ type server struct {
 	autoOpsService       *string
 	codeReferenceService *string
 	// auth
+	refreshTokenTTL     *time.Duration
 	emailFilter         *string
 	oauthConfigPath     *string
 	oauthPublicKeyPath  *string
@@ -287,6 +288,10 @@ func RegisterCommand(r cli.CommandRegistry, p cli.ParentCommand) cli.Command {
 			"Path to public key used to verify oauth token.",
 		).Required().String(),
 		// auth
+		refreshTokenTTL: cmd.Flag(
+			"refresh-token-ttl",
+			"TTL for refresh token.",
+		).Default("168h").Duration(),
 		emailFilter:     cmd.Flag("email-filter", "Regexp pattern for filtering email.").String(),
 		oauthConfigPath: cmd.Flag("oauth-config-path", "Path to oauth config.").Required().String(),
 		oauthPrivateKeyPath: cmd.Flag(
@@ -825,6 +830,7 @@ func (s *server) createAuthService(
 	}
 	serviceOptions := []authapi.Option{
 		authapi.WithLogger(logger),
+		authapi.WithRefreshTokenTTL(*s.refreshTokenTTL),
 	}
 	if *s.emailFilter != "" {
 		filter, err := regexp.Compile(*s.emailFilter)