From 684ff03db24d61a89bd80f8f7bcb957cd5249081 Mon Sep 17 00:00:00 2001 From: John Knapp Date: Fri, 12 Jun 2026 11:47:20 -0700 Subject: [PATCH] feat: make CLI token TTL configurable (CLI_TOKEN_TTL_DAYS, default 90d) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CLI tokens were hardcoded to a 30-day expiry. Make the lifetime configurable via the CLI_TOKEN_TTL_DAYS env var, with a longer default of 90 days. The value must be a positive integer number of days; unset or invalid input falls back to 90. All other token claims are unchanged. Only affects newly minted tokens — already-issued tokens keep their original exp. Co-Authored-By: Claude Opus 4.8 (1M context) --- .env.example | 5 +++++ apps/web/lib/auth/cli-token.ts | 21 ++++++++++++++++++++- 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/.env.example b/.env.example index abd8a1f..b149c68 100644 --- a/.env.example +++ b/.env.example @@ -70,6 +70,11 @@ NEXTAUTH_SECRET=replace-me-with-32-bytes-of-random # ----------------------------------------------------------------------------- CLI_TOKEN_SECRET=replace-me-with-32-bytes-of-random +# Lifetime (in days) of newly minted CLI tokens. Positive integer; unset or +# invalid values fall back to 90. Only affects tokens minted after this is set — +# already-issued tokens keep their original expiry. +# CLI_TOKEN_TTL_DAYS=90 + # ----------------------------------------------------------------------------- # App # ----------------------------------------------------------------------------- diff --git a/apps/web/lib/auth/cli-token.ts b/apps/web/lib/auth/cli-token.ts index 420e1a3..02fece3 100644 --- a/apps/web/lib/auth/cli-token.ts +++ b/apps/web/lib/auth/cli-token.ts @@ -29,7 +29,26 @@ import { cliTokens } from "@/lib/db/schema"; export const CLI_TOKEN_KID = "cli-v1"; export const CLI_TOKEN_ISSUER = "shared-memory:cli"; -export const CLI_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30; // 30 days + +// Default lifetime for newly minted CLI tokens. Overridable via the +// CLI_TOKEN_TTL_DAYS env var (must be a positive integer number of days); +// anything unset/invalid falls back to this default. Only affects tokens +// minted from now on — already-issued tokens keep their original `exp`. +const DEFAULT_CLI_TOKEN_TTL_DAYS = 90; + +function cliTokenTtlSeconds(): number { + const raw = process.env.CLI_TOKEN_TTL_DAYS; + let days = DEFAULT_CLI_TOKEN_TTL_DAYS; + if (raw !== undefined && raw.trim() !== "") { + const parsed = Number(raw); + if (Number.isInteger(parsed) && parsed > 0) { + days = parsed; + } + } + return days * 60 * 60 * 24; +} + +export const CLI_TOKEN_TTL_SECONDS = cliTokenTtlSeconds(); function secret(): Uint8Array { return new TextEncoder().encode(env().CLI_TOKEN_SECRET);