feat: Make session maxAge configurable with environment variable (#5830)

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Matti Nannt <mail@matti.sh> Co-authored-by: Matthias Nannt <mail@matthiasnannt.com> Co-authored-by: Piyush Gupta <piyushguptaa2z123@gmail.com>
2025-12-30 02:10:12 -06:00 · 2025-05-21 05:49:18 +00:00
parent 342d2b1fc4
commit 0e7f3adf53
35 changed files with 48 additions and 3 deletions
--- a/.env.example
+++ b/.env.example
@@ -212,4 +212,7 @@ UNKEY_ROOT_KEY=
 # SENTRY_AUTH_TOKEN=

 # Configure the minimum role for user management from UI(owner, manager, disabled)
-# USER_MANAGEMENT_MINIMUM_ROLE="manager"
+# USER_MANAGEMENT_MINIMUM_ROLE="manager"
+
+# Configure the maximum age for the session in seconds. Default is 43200 (12 hours)
+# SESSION_MAX_AGE=43200
--- a/apps/web/app/(app)/(onboarding)/environments/[environmentId]/layout.test.tsx
+++ b/apps/web/app/(app)/(onboarding)/environments/[environmentId]/layout.test.tsx
@@ -85,6 +85,7 @@ vi.mock("@/lib/constants", () => ({
  OIDC_AUTH_URL: "https://mock-oidc-auth-url.com",
  OIDC_ISSUER: "https://mock-oidc-issuer.com",
  OIDC_SIGNING_ALGORITHM: "RS256",
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("next/navigation", () => ({
--- a/apps/web/app/(app)/(onboarding)/organizations/[organizationId]/landing/layout.test.tsx
+++ b/apps/web/app/(app)/(onboarding)/organizations/[organizationId]/landing/layout.test.tsx
@@ -88,6 +88,7 @@ vi.mock("@/lib/constants", () => ({
  OIDC_AUTH_URL: "https://mock-oidc-auth-url.com",
  OIDC_ISSUER: "https://mock-oidc-issuer.com",
  OIDC_SIGNING_ALGORITHM: "RS256",
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("@/lib/environment/service");
--- a/apps/web/app/(app)/(onboarding)/organizations/[organizationId]/landing/page.test.tsx
+++ b/apps/web/app/(app)/(onboarding)/organizations/[organizationId]/landing/page.test.tsx
@@ -97,6 +97,7 @@ vi.mock("@/lib/constants", () => ({
  OIDC_AUTH_URL: "https://mock-oidc-auth-url.com",
  OIDC_ISSUER: "https://mock-oidc-issuer.com",
  OIDC_SIGNING_ALGORITHM: "RS256",
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("@/app/(app)/(onboarding)/organizations/[organizationId]/landing/components/landing-sidebar", () => ({
--- a/apps/web/app/(app)/(onboarding)/organizations/[organizationId]/layout.test.tsx
+++ b/apps/web/app/(app)/(onboarding)/organizations/[organizationId]/layout.test.tsx
@@ -34,6 +34,7 @@ vi.mock("@/lib/constants", () => ({
  OIDC_SIGNING_ALGORITHM: "test-oidc-signing-algorithm",
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("next-auth", () => ({
--- a/apps/web/app/(app)/(onboarding)/organizations/[organizationId]/projects/new/layout.test.tsx
+++ b/apps/web/app/(app)/(onboarding)/organizations/[organizationId]/projects/new/layout.test.tsx
@@ -33,6 +33,7 @@ vi.mock("@/lib/constants", () => ({
  OIDC_SIGNING_ALGORITHM: "test-oidc-signing-algorithm",
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
+  SESSION_MAX_AGE: 1000,
 }));

 // Mock dependencies
--- a/apps/web/app/(app)/environments/[environmentId]/(contacts)/contacts/[contactId]/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/(contacts)/contacts/[contactId]/page.test.tsx
@@ -25,6 +25,7 @@ vi.mock("@/lib/constants", () => ({
  SMTP_HOST: "mock-smtp-host",
  SMTP_PORT: "mock-smtp-port",
  IS_POSTHOG_CONFIGURED: true,
+  SESSION_MAX_AGE: 1000,
 }));

 describe("Contact Page Re-export", () => {
--- a/apps/web/app/(app)/environments/[environmentId]/integrations/airtable/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/integrations/airtable/page.test.tsx
@@ -48,6 +48,7 @@ vi.mock("@/lib/constants", () => ({
  OIDC_CLIENT_SECRET: "test-oidc-client-secret",
  OIDC_SIGNING_ALGORITHM: "test-oidc-signing-algorithm",
  SENTRY_DSN: "mock-sentry-dsn",
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("@/lib/integration/service");
--- a/apps/web/app/(app)/environments/[environmentId]/integrations/notion/components/NotionWrapper.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/integrations/notion/components/NotionWrapper.test.tsx
@@ -31,6 +31,7 @@ vi.mock("@/lib/constants", () => ({
  SENTRY_DSN: "mock-sentry-dsn",
  GOOGLE_SHEETS_CLIENT_SECRET: "test-client-secret",
  GOOGLE_SHEETS_REDIRECT_URL: "test-redirect-url",
+  SESSION_MAX_AGE: 1000,
 }));

 // Mock child components
--- a/apps/web/app/(app)/environments/[environmentId]/project/(setup)/app-connection/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/project/(setup)/app-connection/page.test.tsx
@@ -24,6 +24,7 @@ vi.mock("@/lib/constants", () => ({
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
  SENTRY_DSN: "mock-sentry-dsn",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("AppConnectionPage Re-export", () => {
--- a/apps/web/app/(app)/environments/[environmentId]/project/general/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/project/general/page.test.tsx
@@ -24,6 +24,7 @@ vi.mock("@/lib/constants", () => ({
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
  SENTRY_DSN: "mock-sentry-dsn",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("GeneralSettingsPage re-export", () => {
--- a/apps/web/app/(app)/environments/[environmentId]/project/languages/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/project/languages/page.test.tsx
@@ -24,6 +24,7 @@ vi.mock("@/lib/constants", () => ({
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
  SENTRY_DSN: "mock-sentry-dsn",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("LanguagesPage re-export", () => {
--- a/apps/web/app/(app)/environments/[environmentId]/project/look/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/project/look/page.test.tsx
@@ -24,6 +24,7 @@ vi.mock("@/lib/constants", () => ({
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
  SENTRY_DSN: "mock-sentry-dsn",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("ProjectLookSettingsPage re-export", () => {
--- a/apps/web/app/(app)/environments/[environmentId]/project/tags/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/project/tags/page.test.tsx
@@ -24,6 +24,7 @@ vi.mock("@/lib/constants", () => ({
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
  SENTRY_DSN: "mock-sentry-dsn",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("TagsPage re-export", () => {
--- a/apps/web/app/(app)/environments/[environmentId]/project/teams/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/project/teams/page.test.tsx
@@ -24,6 +24,7 @@ vi.mock("@/lib/constants", () => ({
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
  SENTRY_DSN: "mock-sentry-dsn",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("ProjectTeams re-export", () => {
--- a/apps/web/app/(app)/environments/[environmentId]/settings/(account)/layout.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/settings/(account)/layout.test.tsx
@@ -40,6 +40,7 @@ vi.mock("@/lib/constants", () => ({
  WEBAPP_URL: "test-webapp-url",
  IS_PRODUCTION: false,
  SENTRY_DSN: "mock-sentry-dsn",
+  SESSION_MAX_AGE: 1000,
 }));

 const mockGetOrganizationByEnvironmentId = vi.mocked(getOrganizationByEnvironmentId);
--- a/apps/web/app/(app)/environments/[environmentId]/settings/(organization)/teams/page.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/settings/(organization)/teams/page.test.tsx
@@ -29,6 +29,7 @@ vi.mock("@/lib/constants", () => ({
  SMTP_PORT: 587,
  SMTP_USER: "mock-smtp-user",
  SMTP_PASSWORD: "mock-smtp-password",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("TeamsPage re-export", () => {
--- a/apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/components/SurveyAnalysisNavigation.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/components/SurveyAnalysisNavigation.test.tsx
@@ -45,6 +45,7 @@ vi.mock("@/lib/constants", () => ({
  SMTP_PORT: 587,
  SMTP_USER: "mock-smtp-user",
  SMTP_PASSWORD: "mock-smtp-password",
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("@/app/(app)/environments/[environmentId]/components/ResponseFilterContext");
--- a/apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/components/SurveyAnalysisCTA.test.tsx
+++ b/apps/web/app/(app)/environments/[environmentId]/surveys/[surveyId]/(analysis)/summary/components/SurveyAnalysisCTA.test.tsx
@@ -30,6 +30,7 @@ vi.mock("@/lib/constants", () => ({
  SMTP_HOST: "mock-smtp-host",
  SMTP_PORT: "mock-smtp-port",
  IS_POSTHOG_CONFIGURED: true,
+  SESSION_MAX_AGE: 1000,
 }));

 // Create a spy for refreshSingleUseId so we can override it in tests
--- a/apps/web/app/(app)/layout.test.tsx
+++ b/apps/web/app/(app)/layout.test.tsx
@@ -38,6 +38,7 @@ vi.mock("@/lib/constants", () => ({
  POSTHOG_API_KEY: "test-posthog-api-key",
  FORMBRICKS_ENVIRONMENT_ID: "mock-formbricks-environment-id",
  IS_FORMBRICKS_ENABLED: true,
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("@/app/intercom/IntercomClientWrapper", () => ({
--- a/apps/web/lib/constants.ts
+++ b/apps/web/lib/constants.ts
@@ -283,3 +283,5 @@ export const SENTRY_DSN = env.SENTRY_DSN;
 export const PROMETHEUS_ENABLED = env.PROMETHEUS_ENABLED === "1";

 export const USER_MANAGEMENT_MINIMUM_ROLE = env.USER_MANAGEMENT_MINIMUM_ROLE ?? "manager";
+
+export const SESSION_MAX_AGE = Number(env.SESSION_MAX_AGE) || 86400;
--- a/apps/web/lib/env.ts
+++ b/apps/web/lib/env.ts
@@ -105,6 +105,7 @@ export const env = createEnv({
    PROMETHEUS_EXPORTER_PORT: z.string().optional(),
    PROMETHEUS_ENABLED: z.enum(["1", "0"]).optional(),
    USER_MANAGEMENT_MINIMUM_ROLE: z.enum(["owner", "manager", "disabled"]).optional(),
+    SESSION_MAX_AGE: z.string().transform((val) => parseInt(val)).optional(),
  },

  /*
@@ -200,5 +201,6 @@ export const env = createEnv({
    PROMETHEUS_ENABLED: process.env.PROMETHEUS_ENABLED,
    PROMETHEUS_EXPORTER_PORT: process.env.PROMETHEUS_EXPORTER_PORT,
    USER_MANAGEMENT_MINIMUM_ROLE: process.env.USER_MANAGEMENT_MINIMUM_ROLE,
+    SESSION_MAX_AGE: process.env.SESSION_MAX_AGE,
  },
 });
--- a/apps/web/modules/auth/invite/page.test.tsx
+++ b/apps/web/modules/auth/invite/page.test.tsx
@@ -24,6 +24,7 @@ vi.mock("@/lib/constants", () => ({
  FB_LOGO_URL: "https://formbricks.com/logo.png",
  SMTP_HOST: "smtp.example.com",
  SMTP_PORT: "587",
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("next-auth", () => ({
--- a/apps/web/modules/auth/lib/authOptions.ts
+++ b/apps/web/modules/auth/lib/authOptions.ts
@@ -1,4 +1,9 @@
-import { EMAIL_VERIFICATION_DISABLED, ENCRYPTION_KEY, ENTERPRISE_LICENSE_KEY } from "@/lib/constants";
+import {
+  EMAIL_VERIFICATION_DISABLED,
+  ENCRYPTION_KEY,
+  ENTERPRISE_LICENSE_KEY,
+  SESSION_MAX_AGE,
+} from "@/lib/constants";
 import { symmetricDecrypt, symmetricEncrypt } from "@/lib/crypto";
 import { verifyToken } from "@/lib/jwt";
 import { getUserByEmail, updateUser, updateUserLastLoginAt } from "@/modules/auth/lib/user";
@@ -178,7 +183,7 @@ export const authOptions: NextAuthOptions = {
    ...(ENTERPRISE_LICENSE_KEY ? getSSOProviders() : []),
  ],
  session: {
-    maxAge: 3600,
+    maxAge: SESSION_MAX_AGE,
  },
  callbacks: {
    async jwt({ token }) {
--- a/apps/web/modules/organization/settings/api-keys/components/api-key-list.test.tsx
+++ b/apps/web/modules/organization/settings/api-keys/components/api-key-list.test.tsx
@@ -30,6 +30,7 @@ vi.mock("@/lib/constants", () => ({
  OIDC_CLIENT_SECRET: "test-oidc-client-secret",
  OIDC_SIGNING_ALGORITHM: "test-oidc-signing-algorithm",
  WEBAPP_URL: "test-webapp-url",
+  SESSION_MAX_AGE: 1000,
 }));

 // Mock @/lib/env
--- a/apps/web/modules/organization/settings/teams/tests/actions.test.ts
+++ b/apps/web/modules/organization/settings/teams/tests/actions.test.ts
@@ -122,6 +122,7 @@ vi.mock("@/lib/constants", () => ({
  SAML_DATABASE_URL: "test-saml-db-url",
  NEXTAUTH_SECRET: "test-nextauth-secret",
  WEBAPP_URL: "http://localhost:3000",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("Organization Settings Teams Actions", () => {
--- a/apps/web/modules/setup/organization/[organizationId]/invite/page.test.tsx
+++ b/apps/web/modules/setup/organization/[organizationId]/invite/page.test.tsx
@@ -54,6 +54,7 @@ vi.mock("@/lib/constants", () => ({
  TURNSTILE_SITE_KEY: "test-turnstile-site-key",
  SAML_OAUTH_ENABLED: true,
  SMTP_PASSWORD: "smtp-password",
+  SESSION_MAX_AGE: 1000,
 }));

 // Mock the InviteMembers component
--- a/apps/web/modules/setup/organization/create/page.test.tsx
+++ b/apps/web/modules/setup/organization/create/page.test.tsx
@@ -56,6 +56,7 @@ vi.mock("@/lib/constants", () => ({
  TURNSTILE_SITE_KEY: "test-turnstile-site-key",
  SAML_OAUTH_ENABLED: true,
  SMTP_PASSWORD: "smtp-password",
+  SESSION_MAX_AGE: 1000,
 }));

 // Mock the CreateOrganization component
--- a/apps/web/modules/survey/editor/components/end-screen-form.test.tsx
+++ b/apps/web/modules/survey/editor/components/end-screen-form.test.tsx
@@ -49,6 +49,7 @@ vi.mock("@/lib/constants", () => ({
  SMTP_HOST: "mock-smtp-host",
  SMTP_PORT: "mock-smtp-port",
  IS_POSTHOG_CONFIGURED: true,
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("@tolgee/react", () => ({
--- a/apps/web/modules/survey/link/components/verify-email.test.tsx
+++ b/apps/web/modules/survey/link/components/verify-email.test.tsx
@@ -37,6 +37,7 @@ vi.mock("@/lib/constants", () => ({
  SMTP_PORT: 587,
  SMTP_USERNAME: "user@example.com",
  SMTP_PASSWORD: "password",
+  SESSION_MAX_AGE: 1000,
 }));

 vi.mock("@/modules/survey/link/actions");
--- a/apps/web/modules/survey/list/components/survey-card.test.tsx
+++ b/apps/web/modules/survey/list/components/survey-card.test.tsx
@@ -25,6 +25,7 @@ vi.mock("@/lib/constants", () => ({
  FB_LOGO_URL: "https://example.com/mock-logo.png",
  SMTP_HOST: "mock-smtp-host",
  SMTP_PORT: "mock-smtp-port",
+  SESSION_MAX_AGE: 1000,
 }));

 describe("SurveyCard", () => {
--- a/apps/web/modules/survey/list/components/survey-filters.test.tsx
+++ b/apps/web/modules/survey/list/components/survey-filters.test.tsx
@@ -36,6 +36,7 @@ vi.mock("@/lib/constants", () => ({
  WEBAPP_URL: "https://example.com",
  ENCRYPTION_KEY: "mock-encryption-key",
  ENTERPRISE_LICENSE_KEY: "mock-license-key",
+  SESSION_MAX_AGE: 1000,
 }));

 // Track the callback for useDebounce to better control when it fires
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -190,6 +190,9 @@ x-environment: &environment
    # Configure the minimum role for user management from UI(owner, manager, disabled)
    # USER_MANAGEMENT_MINIMUM_ROLE="manager"

+    # Configure the maximum age for the session in seconds. Default is 43200 (12 hours)
+    # SESSION_MAX_AGE=43200
+
 services:
  postgres:
    restart: always
--- a/docs/self-hosting/configuration/environment-variables.mdx
+++ b/docs/self-hosting/configuration/environment-variables.mdx
@@ -69,6 +69,7 @@ These variables are present inside your machine's docker-compose file. Restart t
 | SURVEY_URL                   | Set this to change the domain of the survey.                                                                         | optional                                                | WEBAPP_URL                                                                |
 | SENTRY_DSN                   | Set this to track errors and monitor performance in Sentry.                                                          | optional                                                |
 | SENTRY_AUTH_TOKEN            | Set this if you want to make errors more readable in Sentry.                                                         | optional                                                |
+| SESSION_MAX_AGE              | Configure the maximum age for the session in seconds.                                                                | optional                                                | 86400 (24 hours)                                                          |
 | USER_MANAGEMENT_MINIMUM_ROLE | Set this to control which roles can access user management features. Accepted values: "owner", "manager", "disabled" | optional                                                | manager                                                                   |

 Note: If you want to configure something that is not possible via above, please open an issue on our GitHub repo here or reach out to us on Github Discussions and we'll try our best to work out a solution with you.
--- a/turbo.json
+++ b/turbo.json
@@ -139,6 +139,7 @@
        "S3_REGION",
        "S3_SECRET_KEY",
        "SAML_DATABASE_URL",
+        "SESSION_MAX_AGE",
        "SENTRY_DSN",
        "SLACK_CLIENT_ID",
        "SLACK_CLIENT_SECRET",