From 9a48d5af3aa64f5b4adf278035f255fe91bb0acb Mon Sep 17 00:00:00 2001
From: Haoqing Wang <78337154+hqhq1025@users.noreply.github.com>
Date: Sat, 11 Apr 2026 22:03:50 +0800
Subject: [PATCH] fix(hub,web): extend JWT expiration and harden visibility
 refresh (#442)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Extend JWT expiration from 15 minutes to 4 hours in both auth and
  bind endpoints. 15 minutes was too short — browser timer throttling
  in background tabs prevented the scheduled refresh from firing
  before expiration, causing unexpected logouts.

- Change the visibility/focus refresh from conditional (minTtlMs) to
  forced, so returning to a backgrounded tab always re-authenticates
  regardless of remaining token TTL. This eliminates the race between
  timer throttling and token expiration.

HAPI is a self-hosted tool, so the longer token lifetime is an
acceptable security tradeoff. The auth source (Telegram initData or
CLI access token) is still validated on every refresh.

Closes #412
---
 hub/src/web/routes/auth.ts | 2 +-
 hub/src/web/routes/bind.ts | 2 +-
 web/src/hooks/useAuth.ts   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hub/src/web/routes/auth.ts b/hub/src/web/routes/auth.ts
index 8d287b02..b66f36bd 100644
--- a/hub/src/web/routes/auth.ts
+++ b/hub/src/web/routes/auth.ts
@@ -71,7 +71,7 @@ export function createAuthRoutes(jwtSecret: Uint8Array, store: Store): Hono<WebA
         const token = await new SignJWT({ uid: userId, ns: namespace })
             .setProtectedHeader({ alg: 'HS256' })
             .setIssuedAt()
-            .setExpirationTime('15m')
+            .setExpirationTime('4h')
             .sign(jwtSecret)
 
         return c.json({
diff --git a/hub/src/web/routes/bind.ts b/hub/src/web/routes/bind.ts
index 32f77061..f4962fda 100644
--- a/hub/src/web/routes/bind.ts
+++ b/hub/src/web/routes/bind.ts
@@ -51,7 +51,7 @@ export function createBindRoutes(jwtSecret: Uint8Array, store: Store): Hono<WebA
         const token = await new SignJWT({ uid: userId, ns: namespace })
             .setProtectedHeader({ alg: 'HS256' })
             .setIssuedAt()
-            .setExpirationTime('15m')
+            .setExpirationTime('4h')
             .sign(jwtSecret)
 
         return c.json({
diff --git a/web/src/hooks/useAuth.ts b/web/src/hooks/useAuth.ts
index 054ced5a..66343c9f 100644
--- a/web/src/hooks/useAuth.ts
+++ b/web/src/hooks/useAuth.ts
@@ -267,7 +267,7 @@ export function useAuth(authSource: AuthSource | null, baseUrl: string): {
         }
 
         const handleActive = () => {
-            void refreshAuth({ minTtlMs: 60_000 })
+            void refreshAuth({ force: true })
         }
 
         const handleVisibilityChange = () => {