Kundenansicht: Einmal-Link aus dem Ticketsystem, Sitzung und Preview-Zugang fuer 2 Stunden, Protokoll

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/services/previewSession.js

@@ -5,11 +5,12 @@ export const PREVIEW_COOKIE_NAME = 'preview_session'
 
 const secret = new TextEncoder().encode(config.preview.sessionSecret)
 
-export async function createPreviewSessionToken(payload) {
+/** maxAgeSec kuerzer als die Standard-Laufzeit z. B. fuer die Kundenansicht (2 Stunden). */
+export async function createPreviewSessionToken(payload, { maxAgeSec = config.preview.sessionMaxAge } = {}) {
   return new SignJWT(payload)
     .setProtectedHeader({ alg: 'HS256' })
     .setIssuedAt()
-    .setExpirationTime(`${config.preview.sessionMaxAge}s`)
+    .setExpirationTime(`${maxAgeSec}s`)
     .sign(secret)
 }
 
@@ -22,14 +23,14 @@ export async function verifyPreviewSessionToken(token) {
   }
 }
 
-export function previewSessionCookieOptions() {
+export function previewSessionCookieOptions({ maxAgeSec = config.preview.sessionMaxAge } = {}) {
   return {
     domain: config.preview.cookieDomain,
     path: '/',
     httpOnly: true,
     secure: process.env.NODE_ENV === 'production',
     sameSite: 'lax',
-    maxAge: config.preview.sessionMaxAge * 1000,
+    maxAge: maxAgeSec * 1000,
   }
 }