upate session dan ws

server/api/auth/keycloak-callback.get.ts

@@ -1,12 +1,9 @@
-// server/api/auth/keycloak-callback.ts - EXTENDED SESSION FIX
+const config = useRuntimeConfig();
+// Define session duration (default to 1 hour if not specified in config)
+const SESSION_DURATION = (config.sessionDurationHours || 1) * 60 * 60; 
 
-// Add this at the top of the file (after imports)
-const SESSION_DURATION = 1 * 60 * 60; // 1 hour in seconds (3600 seconds)
-// Or use one of these alternatives:
-// const SESSION_DURATION = 24 * 60 * 60;        // 1 day
-// const SESSION_DURATION = 30 * 24 * 60 * 60;   // 30 days
-// const SESSION_DURATION = 12 * 60 * 60;        // 12 hours
-// const SESSION_DURATION = 7 * 24 * 60 * 60;   // 7 days
+// This is the MAIN SESSION duration. It controls how long a user stays logged in.
+// Current configuration: 1 hour (3600 seconds).
 
 export default defineEventHandler(async (event) => {
     try {

server/api/auth/keycloak-login.ts

@@ -72,12 +72,17 @@ export default defineEventHandler(async (event) => {
     const state = randomBytes(32).toString('hex')
     console.log('🎲 Generated state:', state.substring(0, 8) + '...')
     
+    const oauthDuration = (config.oauthStateDurationMinutes || 10) * 60; // Default to 10 minutes
+    const isSecure = process.env.NODE_ENV === 'production';
+
     // Store state in session cookie
+    // IMPORTANT: This cookie is ONLY for the login flow (CSRF protection).
+    // It is NOT the main session duration. It expires quickly to ensure security.
     setCookie(event, 'oauth_state', state, {
       httpOnly: true,
-      secure: false,
-      sameSite: 'lax',
-      maxAge: 600 // 10 minutes
+      secure: isSecure, 
+      sameSite: 'lax' as const, 
+      maxAge: oauthDuration
     })
     
     // Build Keycloak authorization URL

server/api/auth/session.get.ts

@@ -74,6 +74,8 @@ export default defineEventHandler(async (event) => {
       accessTokenPayload?: any
       fullSessionObject?: any
       status?: string
+      remainingSeconds?: number
+      idToken?: string
     } = {
       success: true,
       // Basic User Info
@@ -85,6 +87,7 @@ export default defineEventHandler(async (event) => {
 
       // Session Timestamps (optional in SessionResponse)
       expiresAt: session.expiresAt,
+      remainingSeconds: Math.max(0, Math.floor((session.expiresAt - Date.now()) / 1000)),
 
       // Additional debug fields (not in SessionResponse interface)
       idToken: session.idToken,