enhanced-auth.service.ts:564 signs access tokens with no expiry — sign(payload) uses the module default #160

Problem

Two places in the codebase issue access tokens, and they disagree:

src/core/auth/auth.service.ts:99 and :151 are explicit:

const token = this.jwtService.sign(payload, { expiresIn: "15m" });

src/core/auth/enhanced-auth.service.ts:564 is not:

const accessToken = this.jwtService.sign(payload);

generateTokens() builds the payload at lines 556-563 and then signs with no options at all. expiresIn therefore falls back to whatever JwtModule was configured with. If no default expiresIn is registered, the token has no exp claim and never expires.

There is no algorithms option pinned anywhere in src/ — a grep for algorithms: returns nothing — so verification algorithm selection is left to defaults.

Why it matters

This is the login path that also mints refresh tokens (7-day lifetime, line 571 area). If the access token is non-expiring, a leaked token is valid forever and logout cannot actually revoke it. README.md claims short-lived sessions with bcrypt hashing; this contradicts that. The inconsistency between the two auth services also means which behaviour you get depends on which service handled the login, which is very hard to reason about or debug.

Suggested Direction

• Make generateTokens() pass an explicit { expiresIn: ACCESS_TOKEN_TTL }, matching the 15m used in auth.service.ts. Define the TTL once and share it so the two services cannot drift again.
• Pin the signing algorithm in the JwtModule.register() options (algorithms: ['HS256']) so verification cannot be negotiated downward.
• Consider consolidating the two services — auth.service.ts and enhanced-auth.service.ts appear to overlap heavily, and that overlap is what let this divergence happen.

Constraints

• Changing expiry changes client-visible behaviour. Existing sessions will keep their current lifetime until they expire; document it.
• Do not change the 7-day refresh token lifetime in this issue.

Acceptance Criteria

• generateTokens() passes an explicit expiresIn.
• JwtModule configures an explicit algorithms allowlist.
• A unit test decodes the generated token and asserts exp - iat equals the intended TTL.
• A test asserts a token signed past its TTL fails verification.
• The TTL constant is defined in exactly one place and referenced by both auth services.