fix: reject zero/negative JWT expiration at startup

[ShradhaGupta31]

Changes Done:

• Modified config.go to validate jwtExpiration while console startup
• Reject non-positive values of jwtExpiration

Description:
config.yml accepts jwtExpiration: 0s which is a syntactically valid zero duration that the YAML parser accepts without error. At runtime, every issued JWT has exp = time.Now(), so all tokens expire at the moment of issuance and every subsequent API call is rejected.

Before fix : Server starts silently with jwtExpiration 0s, login returns an already-expired token:

$ curl -s -X POST http://localhost:8181/api/v1/authorize -H 'Content-Type: application/json' -d '{"username":<USER_NAME>,"password":<PASSWORD>}'
{"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."} 

$ curl -s http://localhost:8181/api/v1/devices -H "Authorization: Bearer <token>"
{"error":"invalid access token"} # immediately rejected

After fix : Server would fail to start if jwtExpiration is set to 0s

$ GIN_MODE=debug go run ./cmd/app --config config.yml
Config error: config: auth.jwtExpiration must be positive (e.g. 24h) — zero causes tokens to expire on issuance
exit status 1

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.47%. Comparing base (861e864) to head (e990ba4).

Files with missing lines	Patch %	Lines
config/config.go	66.66%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1172      +/-   ##
==========================================
+ Coverage   44.45%   44.47%   +0.01%     
==========================================
  Files         144      144              
  Lines       13732    13741       +9     
==========================================
+ Hits         6105     6111       +6     
- Misses       7054     7056       +2     
- Partials      573      574       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR prevents a misconfigured auth.jwtExpiration / auth.redirectionJWTExpiration (zero or negative durations) from allowing the server to start and then immediately issuing already-expired JWTs, which effectively denies access to legitimate users.

Changes:

• Adds startup-time config validation for JWT expiration durations.
• Introduces sentinel errors for invalid JWT expiration settings.
• Adds unit tests covering zero/negative durations and valid defaults.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
config/config.go	Adds Config.validate() and calls it from NewConfig() to fail fast on non-positive JWT expirations.
config/config_test.go	Adds tests ensuring validation rejects zero/negative expirations and accepts defaults.

Suppressed comments (3)

config/config_test.go:133

• The test asserts via substring matching on the error string. Since validate() returns a sentinel error, use require.ErrorIs so the test remains stable if the message wording changes.

	err := cfg.validate()
	require.Error(t, err)
	assert.Contains(t, err.Error(), "auth.jwtExpiration")
}

config/config_test.go:144

• The test asserts via substring matching on the error string. Since validate() returns a sentinel error, use require.ErrorIs so the test remains stable if the message wording changes.

	err := cfg.validate()
	require.Error(t, err)
	assert.Contains(t, err.Error(), "auth.redirectionJWTExpiration")
}

config/config_test.go:155

• The test asserts via substring matching on the error string. Since validate() returns a sentinel error, use require.ErrorIs so the test remains stable if the message wording changes.

	err := cfg.validate()
	require.Error(t, err)
	assert.Contains(t, err.Error(), "auth.redirectionJWTExpiration")
}