fix(oauth): report access-token expires_in as the configured TTL

Authly's AccessToken#expires_in derives from an ACCESS_TTL constant
captured at class-load time, before configure! applies the 2-hour access
TTL, so the token response reported the authly default of 3600s while
the JWT exp claim was a full 7200s. Report the live configured TTL so
the RFC 6749 expires_in matches both the JWT exp and the legacy 2-hour
Ruby service.

Author: chillfox

spec/controllers/oauth_token_claims_spec.cr

@@ -133,6 +133,49 @@ module PlaceOS::Auth
       end
     end
 
+    describe "token lifetime" do
+      # The legacy Ruby service issues 2-hour (7200s) access tokens.
+      # authly's AccessToken#expires_in captures the default 1-hour TTL at
+      # class-load time (before configure! runs), so the response under-
+      # reported the lifetime while the JWT exp claim was a full 2 hours.
+      it "reports expires_in consistent with the JWT exp (~7200s)" do
+        authority = ::PlaceOS::Model::Authority.find_by_domain("localhost").not_nil!
+        user = ::PlaceOS::Model::Generator.user(authority).tap do |u|
+          u.password = "ignored-#{Random.rand(99999)}"
+          u.save!
+        end
+        app = ::PlaceOS::Model::DoorkeeperApplication.new
+        app.name = "ttl-test-#{Random.rand(99999)}"
+        app.redirect_uri = "https://app.example/cb"
+        app.scopes = "public"
+        app.owner_id = user.id.as(String)
+        app.save!
+
+        headers = HTTP::Headers{
+          "Host"         => "localhost",
+          "Content-Type" => "application/x-www-form-urlencoded",
+        }
+        body = URI::Params.build do |fp|
+          fp.add("grant_type", "client_credentials")
+          fp.add("client_id", app.uid.as(String))
+          fp.add("client_secret", app.secret)
+          fp.add("scope", "public")
+        end
+        result = client.post("/auth/token", headers: headers, body: body)
+        result.status_code.should eq 200
+        parsed = JSON.parse(result.body)
+
+        parsed["expires_in"].as_i64.should be >= 7100
+        parsed["expires_in"].as_i64.should be <= 7200
+
+        claims = decode_claims.call(parsed["access_token"].as_s)
+        (claims["exp"].as_i - claims["iat"].as_i).should be_close(7200, 5)
+      ensure
+        app.try &.destroy
+        user.try &.destroy
+      end
+    end
+
     describe "claim set" do
       # The legacy Ruby token carries no `cid` claim; authly adds one by
       # default. Drop it so the emitted claim set matches Doorkeeper's.

src/placeos-auth/controllers/oauth.cr

@@ -38,10 +38,14 @@ module PlaceOS::Auth
         @id_token = at.id_token
         @scope = at.scope.presence
 
-        # `Authly::AccessToken#expires_in` is initialised to an
-        # absolute unix timestamp, not the relative `expires_in` of
-        # RFC 6749. Convert.
-        @expires_in = (at.expires_in - Time.utc.to_unix).clamp(0_i64, Int64::MAX)
+        # `Authly::AccessToken#expires_in` is an absolute unix timestamp
+        # derived from a TTL constant captured at class-load time — before
+        # our `configure!` sets the 2-hour access TTL — so it reports the
+        # authly default (1 hour) and disagrees with the token's own `exp`
+        # claim (which uses the live config). Report the configured TTL so
+        # the relative RFC 6749 `expires_in` matches the JWT and the legacy
+        # 2-hour service.
+        @expires_in = ::Authly.config.access_ttl.total_seconds.to_i64
       end
     end