From 1df02cb9f5b10e31e5dfc9016ddf622b8d8b2bd6 Mon Sep 17 00:00:00 2001
From: Karl Ludwig Weise <ludwig@ludwigweise.de>
Date: Mon, 19 Jan 2026 16:40:20 +0100
Subject: [PATCH] Minimize cases where the access_token is still set, but
 invalid

---
 src/routes/api/admin/tenant/+server.ts | 2 +-
 src/routes/api/auth/login/+server.ts   | 2 +-
 src/routes/api/auth/refresh/+server.ts | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/routes/api/admin/tenant/+server.ts b/src/routes/api/admin/tenant/+server.ts
index 183d684..000f3ff 100644
--- a/src/routes/api/admin/tenant/+server.ts
+++ b/src/routes/api/admin/tenant/+server.ts
@@ -97,7 +97,7 @@ export const POST: RequestHandler = async ({ request, locals, cookies }) => {
       secure: true,
       sameSite: "strict",
       path: "/",
-      maxAge: 60 * 60 * 24 * 7, // 7 days
+      maxAge: 60 * 15,
     });
 
     logger.info("Tenant switched successfully", {
diff --git a/src/routes/api/auth/login/+server.ts b/src/routes/api/auth/login/+server.ts
index 7c3566c..67a43c0 100644
--- a/src/routes/api/auth/login/+server.ts
+++ b/src/routes/api/auth/login/+server.ts
@@ -279,7 +279,7 @@ export const POST: RequestHandler = async ({ request, cookies, getClientAddress,
       secure: true,
       sameSite: "strict",
       path: "/",
-      maxAge: 60 * 60 * 24 * 7, // 7 days
+      expires: sessionData.expiresAt,
     });
 
     logger.info("Login successful", {
diff --git a/src/routes/api/auth/refresh/+server.ts b/src/routes/api/auth/refresh/+server.ts
index 1dddc88..aa1b176 100644
--- a/src/routes/api/auth/refresh/+server.ts
+++ b/src/routes/api/auth/refresh/+server.ts
@@ -102,7 +102,7 @@ export const POST: RequestHandler = async ({ cookies }) => {
       secure: true,
       sameSite: "strict",
       path: "/",
-      maxAge: 60 * 60 * 24 * 7, // 7 days
+      expires: result.expiresAt,
     });
 
     return json({