login: a login given a lifetime of its own ends its session's record with it

Ending a session records it in the document until the login's end
(login_exp), so every token of the session, refreshed or handed over, is
refused until none can live any longer. A login may ask a lifetime of
its own (POST /auth/login with lifetime): its session ends with that
token (session_exp), as a refresh never goes past it. Its login_exp is
now that end too, so ending its session records it as long as one of its
tokens can live, not for the node's whole session lifetime. A token
refreshed with a lifetime (one handed to another member's dashboard)
keeps the login's end.

1 files changed, 2 insertions, 1 deletions

diff --git a/src/api/login.rs b/src/api/login.rs
index 1c8aa44..c5cbe8d 100644
--- a/src/api/login.rs
+++ b/src/api/login.rs
@@ -262,6 +262,7 @@ fn new_login(
     let exp = now
         .saturating_add(lifetime_ms(state, lifetime))
         .min(session_exp);
+    let session_exp = ended_with(session_exp, exp, lifetime);
     Claims {
         v: 1,
         swarm,
@@ -271,7 +272,7 @@ fn new_login(
         iat: now,
         exp,
         session: token::new_session(),
-        session_exp: ended_with(session_exp, exp, lifetime),
+        session_exp,
         login_exp: session_exp,
         limit,
     }