[coderback]

Why

The user kept getting logged out of Windrush.

/login called create_access_token without an expiry, so every token used its 15-minute default, though auth.ACCESS_TOKEN_EXPIRE_MINUTES says 7 days. A quarter of an hour after signing in, the next request got a 401. frontend/src/app/api.ts then dropped the token and sent the browser to /login, over and over.

The signing key comes from JWT_SECRET in .env, so API rebuilds weren't the cause.

What changed

• auth.create_access_token now defaults to ACCESS_TOKEN_EXPIRE_MINUTES (7 days); an explicit expires_delta still wins.

Tests

• The tests' client_for fixture skips authentication, which is why nothing caught this. New tests/test_auth.py signs in for real:
  • the token lasts 7 days, and it works on /persona;
  • a wrong password gets a 401 and no token.
• The first test fails on the old default and passes now.
• Fast suite: 1076 passed.

After deploy

Rebuild the API with docker compose up -d --build api. A token issued before the fix still expires 15 minutes after its sign-in; the next sign-in lasts a week.