feat: make http session cookie path & duration configurable (fixes #10522) (#10632)

Signed-off-by: Vikram Vaswani <2571660+vvaswani@users.noreply.github.com>
Signed-off-by: Jakob Borg <jakob@kastelo.net>
Co-authored-by: Jakob Borg <jakob@kastelo.net>

lib/api/api_auth_test.go

@@ -7,6 +7,7 @@
 package api
 
 import (
+	"math"
 	"testing"
 	"time"
 
@@ -192,3 +193,43 @@ func TestTokenManager(t *testing.T) {
 		t.Errorf("token %q should be invalid", t3)
 	}
 }
+
+func TestTokenManagerNoExpiry(t *testing.T) {
+	t.Parallel()
+
+	mdb, err := sqlite.Open(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		mdb.Close()
+	})
+	kdb := db.NewMiscDB(mdb)
+	clock := &mockClock{now: time.Now()}
+
+	tm := newTokenManager("testTokensNoExpiry", kdb, -1, 3)
+	tm.timeNow = clock.Now
+
+	token := tm.New()
+	if expiry, ok := tm.tokens.Tokens[token]; !ok || expiry != 0 {
+		t.Fatalf("token should have no expiry, got %d", expiry)
+	}
+
+	clock.wind(365 * 24 * time.Hour)
+	if !tm.Check(token) {
+		t.Fatal("token should still be valid after long time when no-expiry is enabled")
+	}
+}
+
+func TestSessionCookieMaxAgeNoExpiry(t *testing.T) {
+	t.Parallel()
+
+	m := tokenCookieManager{
+		guiCfg: config.GUIConfiguration{
+			SessionCookieDurationS: -1,
+		},
+	}
+	if got := m.sessionCookieMaxAge(); got != math.MaxInt32 {
+		t.Fatalf("unexpected max age %d", got)
+	}
+}