fix(auth): cookie lifetime now matches the JWT exp, not a stale 8h fallback

Users who came back to the editor 9+ hours after logging in were
getting a confusing "OAuth token has expired" error from HF when
the server tried to push to the dataset on their behalf. The
underlying HF JWT is valid for 30 days but our cookie was set
to 8 hours, so the cookie died first, the browser stopped
sending it, /api/auth/status flipped to unauthenticated, and
the background push retried with the old _cachedToken until it
finally got 401'd by HF.

Fix the cookie lifetime to match the real JWT exp claim:

- Decode the JWT (no signature verification - we just want exp,
HF re-checks the signature on every API call anyway) and use
`exp - now` directly. That's the most authoritative "when does
this stop working" signal available.
- Fall back to `expires_in` from the OAuth /token response if
decoding fails (malformed JWT, future format change, ...).
- Floor at 30 days. The previous fallback was 8 hours which
guaranteed friction even when HF returned a healthy long-lived
token: any code path that read `tokenData.expires_in` as 0 or
undefined hit the floor and the user got booted at lunchtime.
- Cap at 400 days. Browsers clamp cookie max-age past 400d
(RFC 6265bis 5.5) so going higher gets silently truncated.

Users still on an old short-lived cookie need to sign out and
back in once to pick up the new 30-day window. After that, they
keep the same session for the full life of the underlying JWT.

Co-authored-by: Cursor <cursoragent@cursor.com>

README.md

@@ -1,5 +1,5 @@
 ---
-title: Carbon tokenizer
+title: Research Article Template Editor
 emoji: ✏️
 colorFrom: purple
 colorTo: blue

backend/src/auth.ts

@@ -142,7 +142,16 @@ export async function handleOAuthCallback(req: Request, res: Response) {
     }
 
     const tokenData = (await tokenRes.json()) as { access_token: string; expires_in?: number };
-    const maxAge = (tokenData.expires_in || 28800) * 1000;
+
+    // Cookie lifetime strategy: match the underlying JWT's real
+    // expiration so the cookie dies exactly when the token does.
+    // HF currently emits 30-day tokens, but rather than hard-code
+    // that we decode the JWT's `exp` claim (it's a public field,
+    // no verification needed - we just want the timestamp) and use
+    // it directly. Falls back to `expires_in` from the OAuth
+    // response, then to a 30-day floor as a last resort so a
+    // stale 8-hour fallback can never sneak back in.
+    const maxAge = computeCookieMaxAge(tokenData);
 
     res.cookie(COOKIE_NAME, tokenData.access_token, {
       httpOnly: true,
@@ -159,6 +168,65 @@ export async function handleOAuthCallback(req: Request, res: Response) {
   }
 }
 
+/**
+ * Compute the cookie max-age in milliseconds for an HF access token.
+ *
+ * Order of preference:
+ *   1. Decode the JWT's `exp` claim and use `exp - now` directly.
+ *      HF tokens are JWTs and their `exp` is the most authoritative
+ *      "when does this stop working" signal we have.
+ *   2. Fall back to `expires_in` from the OAuth /token response if
+ *      decoding failed (third-party JWT lib unavailable, malformed
+ *      token, etc.).
+ *   3. Floor at 30 days. Anything shorter than that is almost
+ *      certainly a misread - HF currently issues 30-day tokens,
+ *      so an 8-hour fallback would just teach users to mistrust
+ *      the editor when it boots them out mid-day.
+ *   4. Cap at 400 days. That's the maximum Chrome / Chromium-
+ *      derived browsers accept since cookies-with-max-age-greater-
+ *      than-400-days were silently clamped (RFC 6265bis section
+ *      5.5). Setting a larger value would either be silently
+ *      truncated or trigger console warnings.
+ */
+function computeCookieMaxAge(tokenData: {
+  access_token: string;
+  expires_in?: number;
+}): number {
+  const THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000;
+  const FOUR_HUNDRED_DAYS_MS = 400 * 24 * 60 * 60 * 1000;
+
+  let lifeMs = 0;
+
+  // 1. JWT exp claim. We don't verify the signature - that's HF's
+  //    job at every API call - we just read the exp timestamp.
+  try {
+    const parts = tokenData.access_token.split(".");
+    if (parts.length === 3) {
+      // base64url -> base64 -> JSON
+      const padded = parts[1]
+        .replace(/-/g, "+")
+        .replace(/_/g, "/")
+        .padEnd(Math.ceil(parts[1].length / 4) * 4, "=");
+      const payload = JSON.parse(
+        Buffer.from(padded, "base64").toString("utf-8"),
+      );
+      if (typeof payload?.exp === "number") {
+        lifeMs = Math.max(lifeMs, payload.exp * 1000 - Date.now());
+      }
+    }
+  } catch {
+    // Malformed JWT, swallow and fall through to expires_in.
+  }
+
+  // 2. expires_in fallback.
+  if (typeof tokenData.expires_in === "number") {
+    lifeMs = Math.max(lifeMs, tokenData.expires_in * 1000);
+  }
+
+  // 3. & 4. Floor + cap.
+  return Math.min(Math.max(lifeMs, THIRTY_DAYS_MS), FOUR_HUNDRED_DAYS_MS);
+}
+
 /**
  * Clear the HF access token cookie, signing the visitor out of the
  * editor. We mirror every attribute the original `res.cookie(...)`