fix(auth): enforce Keycloak access token age

app/auth/keycloak_dependencies.py

@@ -1,4 +1,4 @@
-# import logging
+import time
 from uuid import UUID
 
 from fastapi import Depends, HTTPException, status
@@ -23,12 +23,22 @@ def _decode_keycloak_token(token: str) -> dict:
 
     key = settings.KEYCLOAK_PUBLIC_KEY.replace("\\n", "\n")
 
-    return jwt.decode(
+    payload = jwt.decode(
         token,
         key,
         algorithms=[settings.KEYCLOAK_ALGORITHM],
         audience=settings.KEYCLOAK_AUDIENCE or None,
     )
+    if settings.KEYCLOAK_ACCESS_TOKEN_MAX_AGE_SECONDS <= 0:
+        return payload
+
+    issued_at = payload.get("iat")
+    if not isinstance(issued_at, (int, float)) or (
+        time.time() >= issued_at + settings.KEYCLOAK_ACCESS_TOKEN_MAX_AGE_SECONDS
+    ):
+        raise JWTError("Keycloak access token is older than the allowed maximum age")
+
+    return payload
 
 
 async def get_current_keycloak_payload(

app/core/config.py

@@ -53,6 +53,7 @@ class Settings(BaseSettings):
     KEYCLOAK_PUBLIC_KEY: str = ""
     KEYCLOAK_ALGORITHM: str = "RS256"
     KEYCLOAK_AUDIENCE: str = ""
+    KEYCLOAK_ACCESS_TOKEN_MAX_AGE_SECONDS: int = 900
 
     # Bocha Web Search API
     BOCHA_API_KEY: str = ""