H1K0 9937984a5a feat(backend): reject non-positive token TTLs at config load ...

Every duration in the config is a token TTL (access, refresh, content). A zero
or negative value mints already-expired tokens — no login, no media playback —
and previously loaded silently. parseDuration now rejects <= 0 with a clear
error, so misconfiguration fails fast at startup instead of mysteriously at
runtime. The AuthService itself stays permissive (it's constructed directly in
tests with arbitrary TTLs); config load is the gate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-15 17:56:25 +03:00

..

config_test.go

feat(backend): reject non-positive token TTLs at config load

2026-06-15 17:56:25 +03:00

config.go

feat(backend): reject non-positive token TTLs at config load

2026-06-15 17:56:25 +03:00