- Refactory cookie and API session handle. Insolated y routes and controllers (api-auth.go, app-auth.go).

- Cookie lifetime with sliding expiration
- Fix bug single global expiresAt in JWT, now each token has unique ExpiresAt

jwt.go

@@ -9,8 +9,8 @@ import (
 )
 
 type JWT struct {
-	signingKey []byte
-	expiresAt  time.Time
+	signingKey      []byte
+	lifetimeMinutes int
 }
 type JWTOptions struct {
 	SigningKey      string
@@ -20,10 +20,9 @@ type JWTOptions struct {
 var j *JWT
 
 func newJWT(opts JWTOptions) *JWT {
-	d := time.Duration(opts.LifetimeMinutes)
 	j = &JWT{
-		signingKey: []byte(opts.SigningKey),
-		expiresAt:  time.Now().Add(d * time.Minute),
+		signingKey:      []byte(opts.SigningKey),
+		lifetimeMinutes: opts.LifetimeMinutes,
 	}
 	return j
 }
@@ -31,13 +30,19 @@ func resolveJWT() *JWT {
 	return j
 }
 
+// LifetimeMinutes returns the configured token lifetime in minutes.
+func (j *JWT) LifetimeMinutes() int {
+	return j.lifetimeMinutes
+}
+
 type claims struct {
 	J []byte
 	jwt.RegisteredClaims
 }
 
 func (j *JWT) GenerateToken(payload map[string]interface{}) (string, error) {
-	claims, err := mapClaims(payload, j.expiresAt)
+	expiresAt := time.Now().Add(time.Duration(j.lifetimeMinutes) * time.Minute)
+	claims, err := mapClaims(payload, expiresAt)
 	if err != nil {
 		return "", err
 	}
@@ -49,6 +54,46 @@ func (j *JWT) GenerateToken(payload map[string]interface{}) (string, error) {
 	return token, nil
 }
 
+// DecodeTokenIgnoreExpiry decodes a token's payload without validating its expiration.
+// It is used to inspect tokens that may already be expired (e.g. sliding session renewal),
+// while still verifying the signature and the token structure.
+func (j *JWT) DecodeTokenIgnoreExpiry(token string) (payload map[string]interface{}, err error) {
+	t, err := jwt.ParseWithClaims(token, &claims{}, func(token *jwt.Token) (interface{}, error) {
+		return j.signingKey, nil
+	}, jwt.WithoutClaimsValidation())
+	if err != nil {
+		return nil, err
+	}
+	c, ok := t.Claims.(*claims)
+	if !ok {
+		return nil, errors.New("error decoding token")
+	}
+	err = json.Unmarshal(c.J, &payload)
+	if err != nil {
+		return nil, err
+	}
+	return payload, nil
+}
+
+// ExpiresAtIgnoreExpiry returns the expiration time carried by the token, without
+// validating it. It verifies the signature and returns the token's "exp" claim.
+func (j *JWT) ExpiresAtIgnoreExpiry(token string) (time.Time, error) {
+	t, err := jwt.ParseWithClaims(token, &claims{}, func(token *jwt.Token) (interface{}, error) {
+		return j.signingKey, nil
+	}, jwt.WithoutClaimsValidation())
+	if err != nil {
+		return time.Time{}, err
+	}
+	c, ok := t.Claims.(*claims)
+	if !ok {
+		return time.Time{}, errors.New("error decoding token")
+	}
+	if c.ExpiresAt == nil {
+		return time.Time{}, errors.New("token has no expiration")
+	}
+	return time.Unix(c.ExpiresAt.Unix(), 0), nil
+}
+
 func (j *JWT) DecodeToken(token string) (payload map[string]interface{}, err error) {
 	t, err := jwt.ParseWithClaims(token, &claims{}, func(token *jwt.Token) (interface{}, error) {
 		return j.signingKey, nil