fix: make the session cookie last as long as Keycloak's

[wilsonrivera]

Summary by CodeRabbit

• New Features
  • Extended authenticated session durations to reduce re-logins and improve continuity: default token expiration is now 14 days. SSO idle timeout increased to 3 days and maximum SSO lifespan to 14 days. Users will stay signed in longer across sessions, enabling smoother multi-day workflows with fewer authentication prompts.

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• Documentation has been updated on https://github.com/wundergraph/cosmo-docs.
• I have read the Contributors Guide.

[coderabbitai]

Walkthrough

Updated session and token lifetimes: JWT default max age extended to 14 days; Keycloak realm settings adjusted to set ssoSessionIdleTimeout to 3 days and ssoSessionMaxLifespan to 14 days.

Changes

Cohort / File(s)	Change summary
Session and token lifespan updates controlplane/src/core/crypto/jwt.ts, docker/keycloak/realm.json, helm/cosmo/templates/keycloak-realm.yml	Increased JWT default max age from 1 day to 14 days. Updated Keycloak ssoSessionIdleTimeout from 1 day (86400) to 3 days (259200) and ssoSessionMaxLifespan from 1 day (86400) to 14 days (1209600).

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

✨ Finishing Touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch wilson/eng-7812-update-session-cookie-duration

---

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR/Issue comments)

Type @coderabbitai help to get the list of available commands.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Status, Documentation and Community

• Visit our Status Page to check the current availability of CodeRabbit.
• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[StarpTech]

LGTM

[coderabbitai]

Actionable comments posted: 2

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 37ee5b0 and 7470b20.

📒 Files selected for processing (2)

• controlplane/src/core/crypto/jwt.ts (1 hunks)
• docker/keycloak/realm.json (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: build_test
• GitHub Check: build_push_image
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (go)

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

helm/cosmo/templates/keycloak-realm.yml (1)

21-22: Parameterize SSO timeouts via Helm values (avoid magic numbers, ease customization)

Hard-coding 259200 and 1209600 makes overrides harder. Suggest wiring these through chart values with sensible defaults.

Apply this diff here:

-      "ssoSessionIdleTimeout": 259200,
-      "ssoSessionMaxLifespan": 1209600,
+      "ssoSessionIdleTimeout": {{ default 259200 .Values.global.keycloak.ssoSessionIdleTimeout | int }},
+      "ssoSessionMaxLifespan": {{ default 1209600 .Values.global.keycloak.ssoSessionMaxLifespan | int }},

And add to values.yaml (or document existing fields) to make the knobs visible:

global:
  keycloak:
    # Seconds. Defaults mirror current behavior: 3 days / 14 days
    ssoSessionIdleTimeout: 259200
    ssoSessionMaxLifespan: 1209600

I can follow up with a PR snippet updating values.yaml and the chart README if helpful.

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 7470b20 and 866f9f9.

📒 Files selected for processing (1)

• helm/cosmo/templates/keycloak-realm.yml (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

• GitHub Check: build_test
• GitHub Check: build_push_image
• GitHub Check: Analyze (javascript-typescript)
• GitHub Check: Analyze (go)

🔇 Additional comments (1)

helm/cosmo/templates/keycloak-realm.yml (1)

21-22: Session timeout settings are consistent across Helm and Docker realm definitions

• helm/cosmo/templates/keycloak-realm.yml and docker/keycloak/realm.json both use
  • ssoSessionIdleTimeout = 259200 (3 days)
  • ssoSessionMaxLifespan = 1209600 (14 days)
• controlplane/src/core/crypto/jwt.ts sets DEFAULT_SESSION_MAX_AGE_SEC = 14 days, and auth-utils uses that for the cookie’s maxAge.

Please confirm whether the cookie should expire on Keycloak’s idle timeout (3 days) instead of its absolute max (14 days). If you want cookie expiry tied to idle, update DEFAULT_SESSION_MAX_AGE_SEC (or compute it from the idle timeout) accordingly.