From 7e96b07191e634589b23ef2ba99f79dc38b2cd57 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 6 Aug 2025 03:26:18 +0000
Subject: [PATCH] Fix JWT authentication to validate session expiration

Co-authored-by: stnguyen90 <1477010+stnguyen90@users.noreply.github.com>
---
 app/init/resources.php | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/init/resources.php b/app/init/resources.php
index bc798aaba8..d8c5fac77b 100644
--- a/app/init/resources.php
+++ b/app/init/resources.php
@@ -273,8 +273,21 @@ App::setResource('user', function ($mode, $project, $console, $request, $respons
 
         $jwtSessionId = $payload['sessionId'] ?? '';
         if (!empty($jwtSessionId)) {
-            if (empty($user->find('$id', $jwtSessionId, 'sessions'))) { // Match JWT to active token
+            $session = $user->find('$id', $jwtSessionId, 'sessions');
+            if (empty($session)) { // Match JWT to active token
                 $user = new Document([]);
+            } else {
+                // Validate session is not expired - check expiration time like Auth::sessionVerify does
+                $sessionExpire = $session->getAttribute('expire');
+                if (
+                    empty($sessionExpire) ||
+                    DatabaseDateTime::formatTz(DatabaseDateTime::format(new \DateTime($sessionExpire))) < DatabaseDateTime::formatTz(DatabaseDateTime::now())
+                ) {
+                    $user = new Document([]);
+                } else {
+                    // Set Auth::unique for consistency with regular session authentication
+                    Auth::$unique = $user->getId();
+                }
             }
         }
     }