fix(auth): recover refresh rotations and configure session lifetime

internal/store/session_test.go

@@ -0,0 +1,42 @@
+package store
+
+import (
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestSessionTTL(t *testing.T) {
+	for _, value := range []string{"", "24h", "168h", "60s"} {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("SESSION_TTL", value)
+			s, err := Open(filepath.Join(t.TempDir(), "db"))
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer s.Close()
+			before := time.Now().Unix()
+			sid, _, err := s.Session("user")
+			if err != nil {
+				t.Fatal(err)
+			}
+			var expiry int64
+			if err = s.DB.QueryRow("SELECT expires FROM sessions WHERE id=?", sid).Scan(&expiry); err != nil {
+				t.Fatal(err)
+			}
+			ttl, _ := sessionLifetime(value)
+			if expiry < before+int64(ttl.Seconds()) || expiry > time.Now().Unix()+int64(ttl.Seconds()) {
+				t.Fatal(expiry)
+			}
+		})
+	}
+	for _, value := range []string{"0", "-1h", "7d", "bad", "500ms", "1.5s"} {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("SESSION_TTL", value)
+			if s, err := Open(filepath.Join(t.TempDir(), "db")); err == nil {
+				s.Close()
+				t.Fatal("invalid TTL accepted")
+			}
+		})
+	}
+}