apps/api/src/auth/localSession.ts

@@ -27,8 +27,15 @@ import type { Context } from 'hono';
 // Cookie name must be distinct from the OIDC cookie 'oidc-auth' (Pitfall 4)
 const COOKIE_NAME = 'local-session';
 
-// Session max age: default 1 day (86400s); configurable via LOCAL_SESSION_EXPIRES env
-const SESSION_MAX_AGE_SECONDS = Number(process.env.LOCAL_SESSION_EXPIRES ?? 86400);
+// Session max age: default 1 day (86400s); configurable via LOCAL_SESSION_EXPIRES env.
+// IN-01: validate the coercion. A malformed value yields NaN, which would produce a JWT
+// with exp = now + NaN (→ NaN) and a cookie maxAge: NaN — making verify behaviour
+// "always expired" or "never expires" depending on the lib's NaN handling. Fall back to
+// the 86400s default for any non-finite or non-positive value.
+const SESSION_MAX_AGE_SECONDS = (() => {
+  const n = Number(process.env.LOCAL_SESSION_EXPIRES ?? 86400);
+  return Number.isFinite(n) && n > 0 ? n : 86400;
+})();
 
 /**
  * Issue a signed local-session JWT cookie for the given userId.