[Lakshya-2440]

Resolves #34 (JWT expiry portion)

Summary

• Add RFC 7519 compliant iat and exp claims to auth tokens generated by create_token().
• Add strict expiration and future-dated token checks in verify_token() with configurable clock-skew leeway (leeway_seconds=60).
• Add DEFAULT_JWT_TTL_SECONDS = 604800 (7 days) with environment override support via env.JWT_TTL_SECONDS.
• Add return type annotation Optional[Dict[str, Any]] to verify_token().
• Rename shadowed exp signature variable in verify_token() to expected_sig.
• Add comprehensive unit test coverage in tests/test_tokens.py.

What was wrong

1. Tokens lived forever: create_token() encoded no exp or iat claims, and verify_token() never validated token timestamps. Leaked tokens remained valid indefinitely.
2. Variable shadowing: exp in verify_token() shadowed the expiration concept with HMAC signature hex string.

Verification

• python3 -m py_compile src/worker.py (syntax passes cleanly)
• pytest tests/test_tokens.py -v: 23 passed in 0.11s
• Regression check across auth, sessions, profile, and dashboard suites: 180 passed in 0.88s

Checklist

• Code compiled without syntax/type errors
• New unit tests added covering expiry, missing exp, bad types, and clock skew
• All existing tests pass cleanly without regression

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e76e317b-f5a3-4a34-be0f-74c1d6716c24

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}