Set up refresh token and ultimate session expiry on initial login

synapse/handlers/register.py

@@ -117,6 +117,7 @@ def __init__(self, hs: "HomeServer"):
 
         self.session_lifetime = hs.config.registration.session_lifetime
         self.access_token_lifetime = hs.config.registration.access_token_lifetime
+        self.refresh_token_lifetime = hs.config.registration.refresh_token_lifetime
 
         init_counters_for_auth_provider("")
 
@@ -810,14 +811,30 @@ class and RegisterDeviceReplicationServlet.
             access_token = self.macaroon_gen.generate_guest_access_token(user_id)
         else:
             if should_issue_refresh_token:
+                now_ms = self.clock.time_msec()
+
+                # Set the refresh token expiry time (if configured)
+                refresh_token_expiry = None
+                if self.refresh_token_lifetime is not None:
+                    refresh_token_expiry = now_ms + self.refresh_token_lifetime
+
+                # Set an ultimate session expiry time (if configured)
+                ultimate_session_expiry_ts = None
+                if self.session_lifetime is not None:
+                    ultimate_session_expiry_ts = now_ms + self.session_lifetime
+
+                # Set the expiry time of the refreshable access token
+                valid_until_ms = now_ms + self.access_token_lifetime
+
                 (
                     refresh_token,
                     refresh_token_id,
                 ) = await self._auth_handler.create_refresh_token_for_user_id(
                     user_id,
                     device_id=registered_device_id,
+                    expiry_ts=refresh_token_expiry,
+                    ultimate_session_expiry_ts=ultimate_session_expiry_ts,
                 )
-                valid_until_ms = self.clock.time_msec() + self.access_token_lifetime
 
             access_token = await self._auth_handler.create_access_token_for_user_id(
                 user_id,