Deprecate/remove AUTH_JWT_EXPIRY

JWT expiration is now controled via AUTH_OAUTH2_ACCESS_TOKEN_LIFETIME

.env.example

@@ -452,12 +452,6 @@
 # Default: 72h
 # AUTH_OAUTH2_REFRESH_TOKEN_LIFETIME=72h
 
-###############################################################################
-# Expiration time for the auth JWT tokens.
-# Type:    time.Duration
-# Default: 720h
-# AUTH_JWT_EXPIRY=720h
-
 ###############################################################################
 # Redirect URL to be sent with OAuth2 authentication request to provider
 # 

app/boot_levels.go

@@ -98,6 +98,11 @@ func (app *CortezaApp) Setup() (err error) {
 					"so instead use environment variable MINIO_BUCKET, " +
 					"we have extended it to have more flexibility over minio bucket name")
 		}
+
+		if _, is := os.LookupEnv("AUTH_JWT_EXPIRY"); is {
+			log.Warn("AUTH_JWT_EXPIRY is removed. " +
+				"JWT expiration value is set from AUTH_OAUTH2_ACCESS_TOKEN_LIFETIME")
+		}
 	}
 
 	hcd := healthcheck.Defaults()
@@ -344,7 +349,7 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) {
 			auth.WithSecretSigner(app.Opt.Auth.Secret),
 			// @todo implement configurable issuer claim
 			//auth.WithDefaultIssuer(app.Opt.Auth.TokenClaimIssuer),
-			auth.WithDefaultExpiration(app.Opt.Auth.Expiry),
+			auth.WithDefaultExpiration(app.Opt.Auth.AccessTokenLifetime),
 			auth.WithDefaultClientID(app.DefaultAuthClient.ID),
 			auth.WithLookup(func(ctx context.Context, accessToken string) (err error) {
 				_, err = store.LookupAuthOa2tokenByAccess(ctx, app.Store, accessToken)

app/options/auth.cue

@@ -58,14 +58,6 @@ auth: schema.#optionsGroup & {
 			defaultGoExpr: "time.Hour * 24 * 3"
 			defaultValue:  "72h"
 		}
-		expiry: {
-			type:        "time.Duration"
-			description: "Expiration time for the auth JWT tokens."
-			env:         "AUTH_JWT_EXPIRY"
-
-			defaultGoExpr: "time.Hour * 24 * 30"
-			defaultValue:  "720h"
-		}
 		external_redirect_URL: {
 			description: """
 				Redirect URL to be sent with OAuth2 authentication request to provider

auth/commands/commands.go

@@ -144,7 +144,7 @@ func Command(ctx context.Context, app serviceInitializer, storeInit func(ctx con
 	jwtCmd.Flags().DurationVar(
 		&tokenDuration,
 		"duration",
-		app.Options().Auth.Expiry,
+		app.Options().Auth.AccessTokenLifetime,
 		"Token expiry duration")
 
 	testEmails := &cobra.Command{

pkg/options/options.gen.go

@@ -99,7 +99,6 @@ type (
 		Secret                   string        `env:"AUTH_JWT_SECRET"`
 		AccessTokenLifetime      time.Duration `env:"AUTH_OAUTH2_ACCESS_TOKEN_LIFETIME"`
 		RefreshTokenLifetime     time.Duration `env:"AUTH_OAUTH2_REFRESH_TOKEN_LIFETIME"`
-		Expiry                   time.Duration `env:"AUTH_JWT_EXPIRY"`
 		ExternalRedirectURL      string        `env:"AUTH_EXTERNAL_REDIRECT_URL"`
 		ExternalCookieSecret     string        `env:"AUTH_EXTERNAL_COOKIE_SECRET"`
 		BaseURL                  string        `env:"AUTH_BASE_URL"`
@@ -515,7 +514,6 @@ func Auth() (o *AuthOpt) {
 		Secret:                   getSecretFromEnv("jwt secret"),
 		AccessTokenLifetime:      time.Hour * 2,
 		RefreshTokenLifetime:     time.Hour * 24 * 3,
-		Expiry:                   time.Hour * 24 * 30,
 		ExternalRedirectURL:      fullURL("/auth/external/{provider}/callback"),
 		ExternalCookieSecret:     getSecretFromEnv("external cookie secret"),
 		BaseURL:                  fullURL("/auth"),

tests/helpers/app.go

@@ -2,7 +2,6 @@ package helpers
 
 import (
 	"context"
-	"time"
 
 	"github.com/cortezaproject/corteza-server/app"
 	"github.com/cortezaproject/corteza-server/pkg/cli"
@@ -30,7 +29,6 @@ func NewIntegrationTestApp(ctx context.Context, initTestServices func(*app.Corte
 
 	// Create a new JWT secret (to prevent any security weirdness)
 	a.Opt.Auth.Secret = string(rand.Bytes(32))
-	a.Opt.Auth.Expiry = time.Minute
 	a.Opt.Auth.DefaultClient = ""
 
 	a.Log = logger.Default()