auth-backend: add experimental refresh token support (#32695)

* auth-backend: add experimental refresh token support Signed-off-by: benjdlambert <ben@blam.sh> * auth-backend: refresh token review fixes Signed-off-by: benjdlambert <ben@blam.sh> * auth-backend: address PR review feedback for refresh tokens Signed-off-by: benjdlambert <ben@blam.sh> --------- Signed-off-by: benjdlambert <ben@blam.sh>
2026-02-10 17:00:51 +01:00
parent cfcc0e583c
commit d0786b968e
18 changed files with 2185 additions and 194 deletions
@@ -99,6 +99,37 @@ export interface Config {
     */
    backstageTokenExpiration?: HumanDuration | string;

+    /**
+     * Configuration for refresh tokens (offline access)
+     * @visibility backend
+     */
+    experimentalRefreshToken?: {
+      /**
+       * Whether to enable refresh tokens
+       * @default false
+       * @visibility backend
+       */
+      enabled?: boolean;
+      /**
+       * Token lifetime before rotation required
+       * @default '30 days'
+       * @visibility backend
+       */
+      tokenLifetime?: HumanDuration | string;
+      /**
+       * Maximum session lifetime across all rotations
+       * @default '1 year'
+       * @visibility backend
+       */
+      maxRotationLifetime?: HumanDuration | string;
+      /**
+       * Maximum number of refresh tokens per user
+       * @default 20
+       * @visibility backend
+       */
+      maxTokensPerUser?: number;
+    };
+
    /**
     * Additional app origins to allow for authenticating
     */