fix: auto logout for tokens with long expiration

wallet-gateway/remote/src/web/frontend/constants.ts

@@ -9,3 +9,5 @@ export const NETWORKS_PAGE_REDIRECT = '/networks'
 export const IDENTITY_PROVIDERS_PAGE_REDIRECT = '/identity-providers'
 
 export const TOKEN_EXPIRED_SKEW_MS = 5000
+// UI sets timeout to trigger logout when token expires. It needs capping, because setTimeout stops delaying if timeout exceed ~24 days (unsigned 32bit in ms)
+export const TOKEN_EXPIRATION_TIMEOUT_LIMIT_MS = 24 * 60 * 60 * 1000

wallet-gateway/remote/src/web/frontend/index.test.ts

@@ -14,6 +14,7 @@ import {
     DEFAULT_PAGE_REDIRECT,
     LOGIN_PAGE_REDIRECT,
     NOT_FOUND_PAGE_REDIRECT,
+    TOKEN_EXPIRATION_TIMEOUT_LIMIT_MS,
 } from './constants.js'
 import { createMockUserClient, mockRequest } from './test-helpers.js'
 
@@ -450,6 +451,7 @@ describe('UserUIAuthRedirect', () => {
 
         mockCreateUserClient.mockReset()
         mockRequest.mockReset()
+        mockAttemptRemoveSession.mockClear()
         setLocationHref.mockReset()
         mockCreateUserClient.mockResolvedValue(createMockUserClient())
         authState.intendedPage = undefined
@@ -535,6 +537,70 @@ describe('UserUIAuthRedirect', () => {
         )
     })
 
+    it('chains bounded timeouts until a long-lived token expires', async () => {
+        const moreThan32Bits = 30 * 24 * 60 * 60 * 1000
+        vi.useFakeTimers({ shouldAdvanceTime: true })
+        const now = new Date('2026-01-01T00:00:00Z')
+        vi.setSystemTime(now)
+        setValidAuth(moreThan32Bits)
+        mockSessionList()
+        setPath('/parties')
+
+        const authSettled = new Promise<Event>((resolve) => {
+            document.addEventListener('auth-settled', resolve, { once: true })
+        })
+        await fixture<UserUIAuthRedirect>(
+            html`<user-ui-auth-redirect></user-ui-auth-redirect>`
+        )
+        await authSettled
+
+        expect(mockAttemptRemoveSession).not.toHaveBeenCalled()
+        expect(setLocationHref).not.toHaveBeenCalled()
+
+        vi.setSystemTime(
+            new Date(now.getTime() + TOKEN_EXPIRATION_TIMEOUT_LIMIT_MS)
+        )
+        await vi.runOnlyPendingTimersAsync()
+
+        expect(mockAttemptRemoveSession).not.toHaveBeenCalled()
+        expect(setLocationHref).not.toHaveBeenCalled()
+
+        vi.setSystemTime(new Date(now.getTime() + moreThan32Bits))
+        await vi.runOnlyPendingTimersAsync()
+
+        expect(mockAttemptRemoveSession).toHaveBeenCalledOnce()
+        expect(setLocationHref).toHaveBeenCalledWith(
+            expect.stringContaining(LOGIN_PAGE_REDIRECT)
+        )
+    })
+
+    it('logs out when a delayed timeout runs after expiration', async () => {
+        vi.useFakeTimers({ shouldAdvanceTime: true })
+        const now = new Date('2026-01-01T00:00:00Z')
+        vi.setSystemTime(now)
+        setValidAuth(2 * TOKEN_EXPIRATION_TIMEOUT_LIMIT_MS)
+        mockSessionList()
+        setPath('/parties')
+
+        const authSettled = new Promise<Event>((resolve) => {
+            document.addEventListener('auth-settled', resolve, { once: true })
+        })
+        await fixture<UserUIAuthRedirect>(
+            html`<user-ui-auth-redirect></user-ui-auth-redirect>`
+        )
+        await authSettled
+
+        vi.setSystemTime(
+            new Date(now.getTime() + 3 * TOKEN_EXPIRATION_TIMEOUT_LIMIT_MS)
+        )
+        await vi.runOnlyPendingTimersAsync()
+
+        expect(mockAttemptRemoveSession).toHaveBeenCalledOnce()
+        expect(setLocationHref).toHaveBeenCalledWith(
+            expect.stringContaining(LOGIN_PAGE_REDIRECT)
+        )
+    })
+
     it('redirects authenticated users on root to the default page', async () => {
         setValidAuth()
         mockSessionList()

wallet-gateway/remote/src/web/frontend/index.ts

@@ -14,6 +14,7 @@ import {
     NOT_FOUND_PAGE_REDIRECT,
     LOGIN_PAGE_REDIRECT,
     TOKEN_EXPIRED_SKEW_MS,
+    TOKEN_EXPIRATION_TIMEOUT_LIMIT_MS,
 } from './constants'
 import {
     AllowedRoute,
@@ -389,13 +390,22 @@ export class UserUIAuthRedirect extends LitElement {
             expirationDate.getTime() - now.getTime() - TOKEN_EXPIRED_SKEW_MS
 
         if (timeUntilExpiration > 0) {
-            tokenExpirationTimeoutId = setTimeout(async () => {
-                const isLoginPage =
-                    getCurrentRoute(window.location.pathname) ===
-                    LOGIN_PAGE_REDIRECT
-                await this.handleExpiredToken(isLoginPage)
-                tokenExpirationTimeoutId = null
-            }, timeUntilExpiration)
+            tokenExpirationTimeoutId = setTimeout(
+                async () => {
+                    tokenExpirationTimeoutId = null
+
+                    if (!this.isTokenExpired(origin)) {
+                        this.setTokenExpirationTimeout(origin)
+                        return
+                    }
+
+                    const isLoginPage =
+                        getCurrentRoute(window.location.pathname) ===
+                        LOGIN_PAGE_REDIRECT
+                    await this.handleExpiredToken(isLoginPage)
+                },
+                Math.min(timeUntilExpiration, TOKEN_EXPIRATION_TIMEOUT_LIMIT_MS)
+            )
         }
     }