Extending session login time

app/services/auth.py

@@ -1,5 +1,7 @@
 """Token issuance / rotation shared by the JSON API and the HTMX UI."""
 
+from datetime import timedelta
+
 import jwt
 from sqlalchemy.ext.asyncio import AsyncSession
 
@@ -13,9 +15,16 @@ from app.crud import token as token_crud
 from app.models.user import User
 
 
-async def issue_token_pair(db: AsyncSession, user: User) -> tuple[str, str]:
-    """Create an access + refresh token and persist the refresh token for revocation."""
-    access = create_access_token(user.id)
+async def issue_token_pair(
+    db: AsyncSession, user: User, access_expires_delta: timedelta | None = None
+) -> tuple[str, str]:
+    """Create an access + refresh token and persist the refresh token for revocation.
+
+    ``access_expires_delta`` overrides the access token's default lifetime
+    (``settings.access_token_expire_minutes``) — used by the web login flow to
+    issue a longer-lived session cookie without affecting API bearer tokens.
+    """
+    access = create_access_token(user.id, access_expires_delta)
     refresh, payload = create_refresh_token(user.id)
     await token_crud.store(
         db,