Keep account sessions for 30 days

A session of a Progmasoft Account, whether opened with a password or with
Google, lasted 12 hours from the sign-in, and the setting could not raise
it beyond 7 days. Sessions now last 30 days by default, and
AccountSessions:LifetimeHours may set anything from 1 hour up to that new
maximum of 720 hours; a value outside the range is clamped to it, as
before.

The lifetime stays fixed from the sign-in; it is not extended by use. The
production environment file sets no lifetime, so the new default applies
there once the API is deployed. Sessions opened before keep the expiry
they were given.

New tests check the 30-day default and the clamping of 0, 12, 720 and
10 000 hours. The account API document gives the new default and range.

1 files changed, 48 insertions, 0 deletions

diff --git a/apps/api-tests/SessionLifetimeTests.cs b/apps/api-tests/SessionLifetimeTests.cs
new file mode 100644
index 0000000..8626186
--- /dev/null
+++ b/apps/api-tests/SessionLifetimeTests.cs
@@ -0,0 +1,48 @@
+// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+// SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+using Microsoft.Extensions.Options;
+using Progmasoft.Progmaweb.Api.Accounts;
+
+namespace Progmasoft.Progmaweb.Api.Tests;
+
+public sealed class SessionLifetimeTests
+{
+    private static readonly DateTimeOffset Now = new(2026, 10, 16, 9, 0, 0, TimeSpan.Zero);
+
+    private sealed class FixedClock(DateTimeOffset now) : TimeProvider
+    {
+        public override DateTimeOffset GetUtcNow() => now;
+    }
+
+    private static async Task<DateTimeOffset> SessionExpiryAsync(AccountSessionOptions options)
+    {
+        InMemoryAccountStore store = new();
+        FixedClock clock = new(Now);
+        AccountService accounts = new(store, clock);
+        SessionService sessions = new(store, clock, Options.Create(options));
+        (AuthenticatedAccount? registration, _) = await accounts.RegisterAsync(
+            new RegisterAccountRequest("LifetimeUser", "lifetime@example.com", "a-long-development-password"),
+            sessions,
+            TestContext.Current.CancellationToken);
+        return Assert.IsType<AuthenticatedAccount>(registration).ExpiresAt;
+    }
+
+    [Fact]
+    public async Task ASessionLastsThirtyDaysByDefault()
+    {
+        Assert.Equal(Now.AddDays(30), await SessionExpiryAsync(new AccountSessionOptions()));
+    }
+
+    [Theory]
+    [InlineData(0, 1)]
+    [InlineData(12, 12)]
+    [InlineData(720, 720)]
+    [InlineData(10_000, 720)]
+    public async Task AConfiguredLifetimeIsKeptWithinOneHourAndThirtyDays(int configured, int expected)
+    {
+        DateTimeOffset expiry = await SessionExpiryAsync(new AccountSessionOptions { LifetimeHours = configured });
+
+        Assert.Equal(Now.AddHours(expected), expiry);
+    }
+}