Merge pull request #734 from zzstoatzz/fix/auth-token-mismatch

Align session expiry with refresh token lifetime

backend/src/backend/_internal/atproto/client.py

···
 import asyncio
 import json
 import logging
+from datetime import UTC, datetime, timedelta
 from typing import Any
 
 from atproto_oauth.models import OAuthSession
···
 
 from backend._internal import Session as AuthSession
 from backend._internal import get_oauth_client, get_session, update_session_tokens
+from backend._internal.auth import (
+    get_client_auth_method,
+    get_refresh_token_lifetime_days,
+)
 
 logger = logging.getLogger(__name__)
 
···
                 "dpop_authserver_nonce": refreshed_session.dpop_authserver_nonce,
                 "dpop_pds_nonce": refreshed_session.dpop_pds_nonce or "",
             }
+            client_auth_method = get_client_auth_method(updated_oauth_data)
+            refresh_lifetime_days = get_refresh_token_lifetime_days(client_auth_method)
+            refresh_expires_at = datetime.now(UTC) + timedelta(
+                days=refresh_lifetime_days
+            )
+            updated_session_data["client_auth_method"] = client_auth_method
+            updated_session_data["refresh_token_lifetime_days"] = refresh_lifetime_days
+            updated_session_data["refresh_token_expires_at"] = (
+                refresh_expires_at.isoformat()
+            )
 
             # update session in database
             await update_session_tokens(session_id, updated_session_data)

backend/src/backend/_internal/auth.py

···
 
 logger = logging.getLogger(__name__)
 
+PUBLIC_REFRESH_TOKEN_DAYS = 14
+CONFIDENTIAL_REFRESH_TOKEN_DAYS = 180
+
 
 def _parse_scopes(scope_string: str) -> set[str]:
     """parse an OAuth scope string into a set of individual scopes.
···
     return bool(settings.atproto.oauth_jwk)
 
 
+def get_client_auth_method(oauth_session_data: dict[str, Any] | None = None) -> str:
+    """resolve client auth method for a session."""
+    if oauth_session_data:
+        method = oauth_session_data.get("client_auth_method")
+        if method in {"public", "confidential"}:
+            return method
+    return "confidential" if is_confidential_client() else "public"
+
+
+def get_refresh_token_lifetime_days(client_auth_method: str | None) -> int:
+    """get expected refresh token lifetime in days."""
+    method = client_auth_method or get_client_auth_method()
+    return (
+        CONFIDENTIAL_REFRESH_TOKEN_DAYS
+        if method == "confidential"
+        else PUBLIC_REFRESH_TOKEN_DAYS
+    )
+
+
+def _compute_refresh_token_expires_at(
+    now: datetime, client_auth_method: str | None
+) -> datetime:
+    """compute refresh token expiration time."""
+    return now + timedelta(days=get_refresh_token_lifetime_days(client_auth_method))
+
+
+def _parse_datetime(value: str | None) -> datetime | None:
+    """parse ISO datetime string safely."""
+    if not value:
+        return None
+    try:
+        return datetime.fromisoformat(value)
+    except ValueError:
+        return None
+
+
+def _get_refresh_token_expires_at(
+    user_session: UserSession,
+    oauth_session_data: dict[str, Any],
+) -> datetime | None:
+    """determine refresh token expiry for a session."""
+    parsed = _parse_datetime(oauth_session_data.get("refresh_token_expires_at"))
+    if parsed:
+        return parsed
+
+    client_auth_method = oauth_session_data.get("client_auth_method")
+    if client_auth_method:
+        return user_session.created_at + timedelta(
+            days=get_refresh_token_lifetime_days(client_auth_method)
+        )
+
+    if user_session.is_developer_token:
+        return user_session.created_at + timedelta(days=PUBLIC_REFRESH_TOKEN_DAYS)
+
+    return None
+
+
 def get_oauth_client(include_teal: bool = False) -> OAuthClient:
     """create an OAuth client with the appropriate scopes.
 
···
         did: user's decentralized identifier
         handle: user's ATProto handle
         oauth_session: OAuth session data to encrypt and store
-        expires_in_days: session expiration in days (default 14, use 0 for no expiration)
+        expires_in_days: session expiration in days (default 14, capped by refresh lifetime)
         is_developer_token: whether this is a developer token (for listing/revocation)
         token_name: optional name for the token (only for developer tokens)
         group_id: optional session group ID for multi-account support
     """
     session_id = secrets.token_urlsafe(32)
+    now = datetime.now(UTC)
 
-    encrypted_data = _encrypt_data(json.dumps(oauth_session))
+    client_auth_method = get_client_auth_method(oauth_session)
+    refresh_lifetime_days = get_refresh_token_lifetime_days(client_auth_method)
+    refresh_expires_at = _compute_refresh_token_expires_at(now, client_auth_method)
 
-    expires_at = (
-        datetime.now(UTC) + timedelta(days=expires_in_days)
-        if expires_in_days > 0
-        else None
+    oauth_session = dict(oauth_session)
+    oauth_session.setdefault("client_auth_method", client_auth_method)
+    oauth_session.setdefault("refresh_token_lifetime_days", refresh_lifetime_days)
+    oauth_session.setdefault("refresh_token_expires_at", refresh_expires_at.isoformat())
+
+    effective_days = (
+        refresh_lifetime_days
+        if expires_in_days <= 0
+        else min(expires_in_days, refresh_lifetime_days)
     )
+    expires_at = now + timedelta(days=effective_days)
+
+    encrypted_data = _encrypt_data(json.dumps(oauth_session))
 
     async with db_session() as db:
         user_session = UserSession(
···
         if decrypted_data is None:
             # decryption failed - session is invalid (key changed or data corrupted)
             # delete the corrupted session
+            await delete_session(session_id)
+            return None
+
+        oauth_session_data = json.loads(decrypted_data)
+
+        refresh_expires_at = _get_refresh_token_expires_at(
+            user_session, oauth_session_data
+        )
+        if refresh_expires_at and datetime.now(UTC) > refresh_expires_at:
             await delete_session(session_id)
             return None
 
···
             session_id=user_session.session_id,
             did=user_session.did,
             handle=user_session.handle,
-            oauth_session=json.loads(decrypted_data),
+            oauth_session=oauth_session_data,
         )
 
 
···
             encryption_algorithm=serialization.NoEncryption(),
         ).decode("utf-8")
 
+        client_auth_method = get_client_auth_method()
+        refresh_lifetime_days = get_refresh_token_lifetime_days(client_auth_method)
+        refresh_expires_at = _compute_refresh_token_expires_at(
+            datetime.now(UTC), client_auth_method
+        )
+
         # store full OAuth session with tokens in database
         session_data = {
             "did": oauth_session.did,
···
             "dpop_private_key_pem": dpop_key_pem,
             "dpop_authserver_nonce": oauth_session.dpop_authserver_nonce,
             "dpop_pds_nonce": oauth_session.dpop_pds_nonce or "",
+            "client_auth_method": client_auth_method,
+            "refresh_token_lifetime_days": refresh_lifetime_days,
+            "refresh_token_expires_at": refresh_expires_at.isoformat(),
         }
         return oauth_session.did, oauth_session.handle, session_data
     except Exception as e:
···
         sessions = result.scalars().all()
 
         tokens = []
+        now = datetime.now(UTC)
         for session in sessions:
+            decrypted_data = _decrypt_data(session.oauth_session_data)
+            oauth_session_data = (
+                json.loads(decrypted_data) if decrypted_data is not None else {}
+            )
+            refresh_expires_at = _get_refresh_token_expires_at(
+                session, oauth_session_data
+            )
+            effective_expires_at = session.expires_at
+            if refresh_expires_at and (
+                effective_expires_at is None
+                or refresh_expires_at < effective_expires_at
+            ):
+                effective_expires_at = refresh_expires_at
+
             # check if expired
-            if session.expires_at and datetime.now(UTC) > session.expires_at:
+            if effective_expires_at and now > effective_expires_at:
                 continue  # skip expired tokens
 
             tokens.append(
···
                     session_id=session.session_id,
                     token_name=session.token_name,
                     created_at=session.created_at,
-                    expires_at=session.expires_at,
+                    expires_at=effective_expires_at,
                 )
             )
 

backend/src/backend/api/auth.py

···
     start_oauth_flow_with_scopes,
     switch_active_account,
 )
+from backend._internal.auth import get_refresh_token_lifetime_days
 from backend._internal.background_tasks import schedule_atproto_sync
 from backend.config import settings
 from backend.models import Artist, get_db
···
     if expires_in_days > max_days:
         raise HTTPException(
             status_code=400,
-            detail=f"expires_in_days cannot exceed {max_days} (use 0 for no expiration)",
+            detail=f"expires_in_days cannot exceed {max_days}",
         )
+
+    refresh_lifetime_days = get_refresh_token_lifetime_days(None)
+    if expires_in_days <= 0 or expires_in_days > refresh_lifetime_days:
+        expires_in_days = refresh_lifetime_days
 
     # start OAuth flow using the user's handle
     auth_url, state = await start_oauth_flow(session.handle)

backend/src/backend/config.py

···
 
     developer_token_default_days: int = Field(
         default=90,
-        description="Default expiration in days for developer tokens (0 = no expiration)",
+        description="Default expiration in days for developer tokens (capped by refresh lifetime)",
     )
     developer_token_max_days: int = Field(
         default=365,

backend/tests/test_auth.py

···
     create_session,
     delete_session,
     get_public_jwks,
+    get_refresh_token_lifetime_days,
     get_session,
     is_confidential_client,
     update_session_tokens,
···
 
 
 async def test_create_session_with_custom_expiration(db_session: AsyncSession):
-    """verify session creation with custom expiration works."""
+    """verify session creation with custom expiration is capped by refresh lifetime."""
     did = "did:plc:customexp123"
     handle = "customexp.bsky.social"
     oauth_data = {"access_token": "token", "refresh_token": "refresh"}
···
     assert db_session_record is not None
     assert db_session_record.expires_at is not None
 
-    # should expire roughly 30 days from now
-    expected_expiry = datetime.now(UTC) + timedelta(days=30)
+    expected_days = min(30, get_refresh_token_lifetime_days(None))
+    # should expire roughly expected_days from now
+    expected_expiry = datetime.now(UTC) + timedelta(days=expected_days)
     actual_expiry = db_session_record.expires_at.replace(tzinfo=UTC)
     diff = abs((expected_expiry - actual_expiry).total_seconds())
     assert diff < 60  # within 1 minute
 
 
 async def test_create_session_with_no_expiration(db_session: AsyncSession):
-    """verify session creation with expires_in_days=0 creates non-expiring session."""
+    """verify session creation with expires_in_days=0 caps to refresh lifetime."""
     did = "did:plc:noexp123"
     handle = "noexp.bsky.social"
     oauth_data = {"access_token": "token", "refresh_token": "refresh"}
···
     assert session is not None
     assert session.did == did
 
-    # verify expires_at is None
+    # verify expires_at is capped to refresh token lifetime
     result = await db_session.execute(
         select(UserSession).where(UserSession.session_id == session_id)
     )
     db_session_record = result.scalar_one_or_none()
     assert db_session_record is not None
-    assert db_session_record.expires_at is None
+    assert db_session_record.expires_at is not None
+
+    expected_days = get_refresh_token_lifetime_days(None)
+    expected_expiry = datetime.now(UTC) + timedelta(days=expected_days)
+    actual_expiry = db_session_record.expires_at.replace(tzinfo=UTC)
+    diff = abs((expected_expiry - actual_expiry).total_seconds())
+    assert diff < 60  # within 1 minute
 
 
 async def test_create_session_default_expiration(db_session: AsyncSession):

docs/authentication.md

···
 backend settings in `AuthSettings`:
 - `developer_token_default_days`: default expiration (90 days)
 - `developer_token_max_days`: max allowed expiration (365 days)
-- use `expires_in_days: 0` for tokens that never expire
+- use `expires_in_days: 0` to request the maximum allowed by refresh lifetime
 
 ### how it works
 
···
 with public clients, the underlying ATProto refresh token expires after 2 weeks regardless of what we store in our database. users would need to re-authenticate with their PDS every 2 weeks.
 
 with confidential clients:
-- **developer tokens actually work long-term** - not limited to 2 weeks
+- **developer tokens work long-term** - not limited to 2 weeks
 - **users don't get randomly kicked out** after 2 weeks of inactivity
-- **sessions last effectively forever** as long as tokens are refreshed within 180 days
+- **sessions last up to refresh lifetime** as long as tokens are refreshed within 180 days
 
 ### how it works
 

docs/frontend/data-loading.md

···
 
 used for:
 - auth-dependent data (liked tracks, user preferences)
-- data that needs client context (localStorage, cookies)
+- data that needs client context (local caches, media state)
 - progressive enhancement
 
 ```typescript
 // frontend/src/routes/liked/+page.ts
 export const load: PageLoad = async ({ fetch }) => {
-	const sessionId = localStorage.getItem('session_id');
-	if (!sessionId) return { tracks: [] };
-
 	const response = await fetch(`${API_URL}/tracks/liked`, {
-		headers: { 'Authorization': `Bearer ${sessionId}` }
+		credentials: 'include'
 	});
+
+	if (!response.ok) return { tracks: [] };
 
 	return { tracks: await response.json() };
 };
 ```
 
 **benefits**:
-- access to browser APIs (localStorage, cookies)
-- runs on client, can use session tokens
+- access to browser APIs (window, local caches)
+- runs on client, can use HttpOnly cookie auth
 - still loads before component mounts (faster than `onMount`)
 
 ### layout loading (`+layout.ts`)
···
 ```typescript
 // frontend/src/routes/+layout.ts
 export async function load({ fetch }: LoadEvent) {
-	const sessionId = localStorage.getItem('session_id');
-	if (!sessionId) return { user: null, isAuthenticated: false };
-
 	const response = await fetch(`${API_URL}/auth/me`, {
-		headers: { 'Authorization': `Bearer ${sessionId}` }
+		credentials: 'include'
 	});
 
 	if (response.ok) {