[TheoBen880]

Shortens the web session token lifetime from 1d to 1h.

[github-actions]

Code Change Impact Report

Summary

The web session JWT lifetime was shortened from one day to one hour in server/web/jwt.ts, which invalidates the documented session-lifecycle statements in the netserv documentation and the newly declared auth-session diagram; no other services, API specs, or test packs are affected.

Affected Services

• netserv — its web session behaviour changed: tokens issued by POST /auth/login and rotated by GET /auth/init now expire after 1h instead of 1d, while the one-year cookie maxAge and restart-based secret rotation are unchanged. The UIGraph dependency graph shows no upstream callers or downstream services for netserv, so the blast radius is confined to this service's own web surface; reviewers should confirm the shorter re-authentication window is intended operational behaviour.

Impacted UIGraph Artifacts

• Web Access Control (doc) — its Session lifecycle section states "The token itself expires after 1d" and derives operational guidance from that (cookie outlives token, stale cookie cleared on the next /auth/init); this is now inaccurate at 1h and needs rewriting.
• Web Auth and Session (diagram, newly declared in this commit) — its context defines the token node as "JWT expiresIn 1d", which contradicts the code changed in the same commit; the context should say 1h before this diagram is trusted or synced.

Impact Summary

• The change is a behavioural tuning with no API shape, route, database, or dependency change, so the OpenAPI specs (netserv-web-api, netserv-transfer-api), the Web API Smoke and Peer Transfer Smoke test packs (no case asserts a token lifetime, and /auth/init rotation keeps smoke sessions valid), and the structural Web Request Flow and Peer File Transfer diagrams remain accurate. The five other newly declared diagrams describe unrelated surfaces (CLI dispatch, FTP, upload, build pipeline) and contain no token-lifetime claims. The two artifacts that must be reviewed are the Web Access Control doc and the Web Auth and Session diagram, both of which still assert the old one-day token expiry.