Fix getVisitorAuthCookieMaxAge returning 60s even when token expiry is much later (#2974)

Author: spastorelli

packages/gitbook/src/lib/visitor-token.test.ts

@@ -1,7 +1,9 @@
 import { describe, expect, it } from 'bun:test';
 import type { NextRequest } from 'next/server';
 
+import type { JwtPayload } from 'jwt-decode';
 import {
+    getVisitorAuthCookieMaxAge,
     getVisitorAuthCookieName,
     getVisitorAuthCookieValue,
     getVisitorToken,
@@ -74,6 +76,47 @@ describe('getVisitorAuthToken', () => {
     });
 });
 
+describe('getVisitorAuthCookieMaxAge', () => {
+    const ONE_MINUTE_IN_SECONDS = 60;
+
+    it('returns the max age of 7 days if token expires in 7 days', () => {
+        const SEVEN_DAYS_IN_SECONDS = 7 * 24 * 60 * 60;
+        const now = Math.floor(Date.now() / 1000);
+        const decoded: JwtPayload = { exp: now + SEVEN_DAYS_IN_SECONDS };
+
+        expect(getVisitorAuthCookieMaxAge(decoded)).toBe(SEVEN_DAYS_IN_SECONDS);
+    });
+
+    it('returns the max age of 30 days if token expires in 30 days', () => {
+        const THIRTY_DAYS_IN_SECONDS = 30 * 24 * 60 * 60;
+        const now = Math.floor(Date.now() / 1000);
+        const decoded: JwtPayload = { exp: now + THIRTY_DAYS_IN_SECONDS };
+
+        expect(getVisitorAuthCookieMaxAge(decoded)).toBe(THIRTY_DAYS_IN_SECONDS);
+    });
+
+    it('returns the minimum max age of 60 seconds if token has already expired', () => {
+        const now = Math.floor(Date.now() / 1000);
+        const decoded: JwtPayload = { exp: now - 1000 };
+
+        expect(getVisitorAuthCookieMaxAge(decoded)).toBe(ONE_MINUTE_IN_SECONDS);
+    });
+
+    it('returns the minimum max age of 60 seconds if token expires in less than 60 seconds', () => {
+        const now = Math.floor(Date.now() / 1000);
+        const decoded: JwtPayload = { exp: now + 30 }; // Expires in 30 seconds
+
+        expect(getVisitorAuthCookieMaxAge(decoded)).toBe(ONE_MINUTE_IN_SECONDS);
+    });
+
+    it('returns the correct value if expiry is in the future but more than 60 seconds', () => {
+        const now = Math.floor(Date.now() / 1000);
+        const decoded: JwtPayload = { exp: now + 300 }; // Expires in 5 minutes
+
+        expect(getVisitorAuthCookieMaxAge(decoded)).toBe(300);
+    });
+});
+
 function assertVisitorAuthCookieValue(
     value: unknown
 ): asserts value is { source: 'visitor-auth-cookie'; basePath: string; token: string } {

packages/gitbook/src/lib/visitor-token.ts

@@ -238,13 +238,13 @@ function findVisitorAuthCookieForBasePath(
  * We want to store the token for as long as it's valid, but at least 1 minute.
  * If an invalid token is passed to the API, the API will return a redirect to the auth flow.
  */
-function getVisitorAuthCookieMaxAge(decoded: JwtPayload): number {
+export function getVisitorAuthCookieMaxAge(decoded: JwtPayload): number {
     const defaultMaxAge = 7 * 24 * 60 * 60; // 7 days
     const minMaxAge = 60; // 1 min
     const exp = decoded.exp;
 
     if (typeof exp === 'number') {
-        const now = new Date().getTime();
+        const now = Math.floor(new Date().getTime() / 1000);
         return Math.max(exp - now, minMaxAge);
     }