feat: allow configurable expiration for refreshToken

[demeyerthom]

This pull request introduces a major change to the refresh token handling in the @labdigital/federated-token package. The main improvement is the addition of support for a configurable expiresIn option when setting refresh tokens, allowing for custom expiration times or session-based expiration. This change is thoroughly tested with new and updated unit tests.

Refresh Token Expiration Improvements:

• Added support for passing a refreshToken.expiresIn option to the setRefreshToken method, enabling custom expiration times or session-based expiration for refresh tokens (cookies-base.ts).
• Updated and expanded unit tests in cookies-base.test.ts to verify behavior with default, custom, and session expiration settings for refresh tokens. [1] [2]

Documentation and Release Notes:

• Added a changeset documenting this as a major change for the @labdigital/federated-token package.

[changeset-bot]

🦋 Changeset detected

Latest commit: 86dce9b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@labdigital/federated-token	Minor
@labdigital/federated-token-apollo	Minor
@labdigital/federated-token-express-adapter	Minor
@labdigital/federated-token-fastify-adapter	Minor
@labdigital/federated-token-yoga	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Pull Request Overview

This pull request adds support for configurable expiration times for refresh tokens in the @labdigital/federated-token package. Previously, refresh tokens had a hardcoded one-year expiration. The changes allow consumers to specify custom expiration durations in seconds or use session-based expiration where tokens expire when the browser closes.

• Added refreshToken.expiresIn option support in BaseCookieSourceOptions
• Updated setRefreshToken method to use configurable expiration instead of hardcoded value
• Added comprehensive test coverage for default, custom, and session expiration scenarios

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
packages/core/src/tokensource/cookies-base.ts	Refactored setRefreshToken to support configurable expiration via refreshToken.expiresIn option, with backward-compatible default of one year
packages/core/src/tokensource/cookies-base.test.ts	Expanded test suite with three test cases covering default (1 year), custom (60s), and session-based expiration scenarios
.changeset/sad-worms-dream.md	Added changeset documenting this feature as a minor version bump

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.