Keep account sessions for 30 days

A session of a Progmasoft Account, whether opened with a password or with
Google, lasted 12 hours from the sign-in, and the setting could not raise
it beyond 7 days. Sessions now last 30 days by default, and
AccountSessions:LifetimeHours may set anything from 1 hour up to that new
maximum of 720 hours; a value outside the range is clamped to it, as
before.

The lifetime stays fixed from the sign-in; it is not extended by use. The
production environment file sets no lifetime, so the new default applies
there once the API is deployed. Sessions opened before keep the expiry
they were given.

New tests check the 30-day default and the clamping of 0, 12, 720 and
10 000 hours. The account API document gives the new default and range.

2 files changed, 9 insertions, 4 deletions

diff --git a/apps/api/Accounts/SessionService.cs b/apps/api/Accounts/SessionService.cs
index d6d04b0..24a81d0 100644
--- a/apps/api/Accounts/SessionService.cs
+++ b/apps/api/Accounts/SessionService.cs
@@ -11,8 +11,13 @@ internal sealed class AccountSessionOptions
 {
     /// <summary>Name of the configuration section.</summary>
     public const string SectionName = "AccountSessions";
-    /// <summary>Hours a session stays valid. Values outside 1 to 168 are clamped to that range.</summary>
-    public int LifetimeHours { get; init; } = 12;
+    /// <summary>The longest a session may stay valid: 30 days.</summary>
+    public const int MaximumLifetimeHours = 30 * 24;
+    /// <summary>
+    /// Hours a session stays valid, 30 days unless configured. Values outside 1 to
+    /// <see cref="MaximumLifetimeHours"/> are clamped to that range.
+    /// </summary>
+    public int LifetimeHours { get; init; } = MaximumLifetimeHours;
     /// <summary>Name of the session cookie. The <c>__Host-</c> prefix binds it to this host over HTTPS.</summary>
     public string CookieName { get; init; } = "__Host-ProgmasoftSession";
 }
@@ -46,7 +51,7 @@ internal sealed class SessionService(
             .TrimEnd('=');
         byte[] digest = SHA256.HashData(System.Text.Encoding.ASCII.GetBytes(token));
         DateTimeOffset createdAt = timeProvider.GetUtcNow();
-        DateTimeOffset expiresAt = createdAt.AddHours(Math.Clamp(settings.LifetimeHours, 1, 168));
+        DateTimeOffset expiresAt = createdAt.AddHours(Math.Clamp(settings.LifetimeHours, 1, AccountSessionOptions.MaximumLifetimeHours));
 
         await store.StoreSessionAsync(new SessionRecord(digest, account.Id, createdAt, expiresAt), cancellationToken);
         return new AuthenticatedAccount(account, token, expiresAt);
diff --git a/apps/api/appsettings.json b/apps/api/appsettings.json
index 5644334..e6b208a 100644
--- a/apps/api/appsettings.json
+++ b/apps/api/appsettings.json
@@ -7,7 +7,7 @@
   },
   "AllowedHosts": "localhost;127.0.0.1;progmasoft.com;account.progmasoft.com;www.progmasoft.com",
   "AccountSessions": {
-    "LifetimeHours": 12,
+    "LifetimeHours": 720,
     "CookieName": "__Host-ProgmasoftSession"
   }
 }