From 66b85a81edc290826a6462f8398f3c182e6fb365 Mon Sep 17 00:00:00 2001
From: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai>
Date: Fri, 22 Mar 2024 18:16:07 -0300
Subject: [PATCH] Update token expiration settings

---
 src/backend/langflow/api/v1/login.py           | 15 +++++++++------
 src/backend/langflow/services/auth/utils.py    |  4 ++--
 src/backend/langflow/services/settings/auth.py |  9 +++------
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/src/backend/langflow/api/v1/login.py b/src/backend/langflow/api/v1/login.py
index 4f44e79bc..0f223ea72 100644
--- a/src/backend/langflow/api/v1/login.py
+++ b/src/backend/langflow/api/v1/login.py
@@ -10,6 +10,7 @@ from langflow.services.auth.utils import (
     create_user_tokens,
 )
 from langflow.services.deps import get_session, get_settings_service
+from langflow.services.settings.manager import SettingsService
 
 router = APIRouter(tags=["Login"])
 
@@ -41,7 +42,7 @@ async def login_to_get_access_token(
             httponly=auth_settings.REFRESH_HTTPONLY,
             samesite=auth_settings.REFRESH_SAME_SITE,
             secure=auth_settings.REFRESH_SECURE,
-            expires=auth_settings.REFRESH_TOKEN_EXPIRE_MINUTES * 60,
+            expires=auth_settings.REFRESH_TOKEN_EXPIRE_SECONDS,
         )
         response.set_cookie(
             "access_token_lf",
@@ -49,7 +50,7 @@ async def login_to_get_access_token(
             httponly=auth_settings.ACCESS_HTTPONLY,
             samesite=auth_settings.ACCESS_SAME_SITE,
             secure=auth_settings.ACCESS_SECURE,
-            expires=auth_settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
+            expires=auth_settings.ACCESS_TOKEN_EXPIRE_SECONDS,
         )
         return tokens
     else:
@@ -75,7 +76,7 @@ async def auto_login(
             httponly=auth_settings.ACCESS_HTTPONLY,
             samesite=auth_settings.ACCESS_SAME_SITE,
             secure=auth_settings.ACCESS_SECURE,
-            expires=auth_settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
+            expires=None,
         )
         return tokens
 
@@ -89,7 +90,9 @@ async def auto_login(
 
 
 @router.post("/refresh")
-async def refresh_token(request: Request, response: Response, settings_service=Depends(get_settings_service)):
+async def refresh_token(
+    request: Request, response: Response, settings_service: "SettingsService" = Depends(get_settings_service)
+):
     auth_settings = settings_service.auth_settings
 
     token = request.cookies.get("refresh_token_lf")
@@ -102,7 +105,7 @@ async def refresh_token(request: Request, response: Response, settings_service=D
             httponly=auth_settings.REFRESH_HTTPONLY,
             samesite=auth_settings.REFRESH_SAME_SITE,
             secure=auth_settings.REFRESH_SECURE,
-            expires=auth_settings.REFRESH_TOKEN_EXPIRE_MINUTES * 60,
+            expires=auth_settings.REFRESH_TOKEN_EXPIRE_SECONDS,
         )
         response.set_cookie(
             "access_token_lf",
@@ -110,7 +113,7 @@ async def refresh_token(request: Request, response: Response, settings_service=D
             httponly=auth_settings.ACCESS_HTTPONLY,
             samesite=auth_settings.ACCESS_SAME_SITE,
             secure=auth_settings.ACCESS_SECURE,
-            expires=auth_settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60,
+            expires=auth_settings.ACCESS_TOKEN_EXPIRE_SECONDS,
         )
         return tokens
     else:
diff --git a/src/backend/langflow/services/auth/utils.py b/src/backend/langflow/services/auth/utils.py
index 6babee5bf..78566fec3 100644
--- a/src/backend/langflow/services/auth/utils.py
+++ b/src/backend/langflow/services/auth/utils.py
@@ -254,13 +254,13 @@ def get_user_id_from_token(token: str) -> UUID:
 def create_user_tokens(user_id: UUID, db: Session = Depends(get_session), update_last_login: bool = False) -> dict:
     settings_service = get_settings_service()
 
-    access_token_expires = timedelta(minutes=settings_service.auth_settings.ACCESS_TOKEN_EXPIRE_MINUTES)
+    access_token_expires = timedelta(seconds=settings_service.auth_settings.ACCESS_TOKEN_EXPIRE_SECONDS)
     access_token = create_token(
         data={"sub": str(user_id)},
         expires_delta=access_token_expires,
     )
 
-    refresh_token_expires = timedelta(minutes=settings_service.auth_settings.REFRESH_TOKEN_EXPIRE_MINUTES)
+    refresh_token_expires = timedelta(seconds=settings_service.auth_settings.REFRESH_TOKEN_EXPIRE_SECONDS)
     refresh_token = create_token(
         data={"sub": str(user_id), "type": "rf"},
         expires_delta=refresh_token_expires,
diff --git a/src/backend/langflow/services/settings/auth.py b/src/backend/langflow/services/settings/auth.py
index 11e08b1c4..3dd92a04a 100644
--- a/src/backend/langflow/services/settings/auth.py
+++ b/src/backend/langflow/services/settings/auth.py
@@ -6,10 +6,7 @@ from passlib.context import CryptContext
 from pydantic import Field, SecretStr, validator
 from pydantic_settings import BaseSettings
 
-from langflow.services.settings.constants import (
-    DEFAULT_SUPERUSER,
-    DEFAULT_SUPERUSER_PASSWORD,
-)
+from langflow.services.settings.constants import DEFAULT_SUPERUSER, DEFAULT_SUPERUSER_PASSWORD
 from langflow.services.settings.utils import read_secret_from_file, write_secret_to_file
 
 
@@ -22,8 +19,8 @@ class AuthSettings(BaseSettings):
         frozen=False,
     )
     ALGORITHM: str = "HS256"
-    ACCESS_TOKEN_EXPIRE_MINUTES: int = 60
-    REFRESH_TOKEN_EXPIRE_MINUTES: int = 60 * 12 * 7
+    ACCESS_TOKEN_EXPIRE_SECONDS: int = 60 * 60  # 1 hour
+    REFRESH_TOKEN_EXPIRE_SECONDS: int = 60 * 60 * 24 * 7  # 7 days
 
     # API Key to execute /process endpoint
     API_KEY_ALGORITHM: str = "HS256"