From 0a7882c5ce9f18fbee514819142e882143d2482e Mon Sep 17 00:00:00 2001
From: zihluwang <real@zihluwang.me>
Date: Tue, 11 Aug 2026 00:54:46 +0800
Subject: [PATCH] feat(auth): add configurable token renew threshold

- Add renew-threshold JWT config option with PT5M default
- Default valid-time to PT2H in TokenProperties
- Expand comments in the prod config example
---
 config/application-prod.yaml.example          | 46 ++++++++++++++++---
 .../properties/TokenProperties.java           |  4 +-
 2 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/config/application-prod.yaml.example b/config/application-prod.yaml.example
index e68c145..010be28 100644
--- a/config/application-prod.yaml.example
+++ b/config/application-prod.yaml.example
@@ -23,28 +23,58 @@ app:
     path: '/'
     max-age: P1D
   cors:
-    allowed-origins: # Cross-origin allowed origins
+    # Cross-origin allowed origins
+    allowed-origins:
       - "http://localhost:5173" # Dev server for vite.
       - "http://localhost:4173" # Preview server for vite.
-    allow-credentials: true # Must be set to `true` since we are using cookie. You can change it only when you have modified how this application executing authentication.
+
+    # Must be set to `true` since we are using cookie. You can change it only when you have
+    # modified how this application executing authentication.
+    allow-credentials: true
+
+    # Whether allow private network addresses.
     allow-private-network: false
+
+    # Allowed headers.
     allowed-headers:
       - "Content-Type"
       - "Authorization"
+
+    # Allowed methods.
+    #
+    # Since the usage of HttpMethod from Spring Framework, all methods should be UPPER CASE.
+    # e.g., GET, POST, PUT, PATCH, DELETE, OPTIONS
     allowed-methods:
       - GET
       - POST
       - PUT
       - PATCH
       - DELETE
+
+    # Headers are allowed being displayed on Web pages.
     exposed-headers:
       - "Content-Type"
       - "Authorization"
+
+    # Cross-origin policy max age.
     max-age: PT2H
   jwt:
-    issuer: dfguide.local # Issuer host
-    secret: qwertyuiopasdfghjklzxcvbnm123456 # JWT singing secret, a 32-byte long or longer string is recommended
-    valid-time: PT2H # JWT valid duration
+    # Issuer host
+    issuer: dfguide.local
+
+    # Token singing secret, a 32-byte long or longer string is recommended
+    secret: qwertyuiopasdfghjklzxcvbnm123456
+
+    # Token valid duration.
+    #
+    # Default to PT2H (2 hours).
+    valid-time: PT2H
+
+    # Token renew threshold. If valid time of this token is less than this value, then a new token
+    # will be delivered to the user.
+    #
+    # Default to PT5M (5 min).
+    renew-threshold: PT5M
   webhook:
     github:
       secret: 123456
@@ -52,6 +82,8 @@ app:
 
 springdoc:
   api-docs:
-    enabled: true # Set to `false` if you do not need api docs (recommended in production mode).
+    # Set to `false` if you do not need api docs (recommended in production mode).
+    enabled: true
   swagger-ui:
-    enabled: true # Set to `false` if you do not need swagger ui (recommended in production mode).
\ No newline at end of file
+    # Set to `false` if you do not need swagger ui (recommended in production mode).
+    enabled: true
\ No newline at end of file
diff --git a/src/main/java/com/onixbyte/deltaforceguide/properties/TokenProperties.java b/src/main/java/com/onixbyte/deltaforceguide/properties/TokenProperties.java
index 74c693c..4deb33a 100644
--- a/src/main/java/com/onixbyte/deltaforceguide/properties/TokenProperties.java
+++ b/src/main/java/com/onixbyte/deltaforceguide/properties/TokenProperties.java
@@ -1,6 +1,7 @@
 package com.onixbyte.deltaforceguide.properties;
 
 import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.bind.DefaultValue;
 
 import java.time.Duration;
 
@@ -16,6 +17,7 @@ import java.time.Duration;
 public record TokenProperties(
         String issuer,
         String secret,
-        Duration validTime
+        @DefaultValue("PT2H") Duration validTime,
+        @DefaultValue("PT5M") Duration renewThreshold
 ) {
 }