fix(session): refresh tokens 30s before expiry instead of 5m

Refreshes are activity-based and synchronous-on-expiry, so the proactive
leeway only hides refresh latency and provides retry headroom; it is not
what prevents serving expired tokens. Shrink it from 5m to 30s to align
with identity provider guidance against refreshing long before expiry,
while keeping decent end-user UX.

docs/sessions.md

@@ -36,7 +36,7 @@ If you've configured a session lifetime that is longer than the token expiry, yo
 The behaviour for refreshing depends on the [runtime mode](configuration.md#modes) for Wonderwall.
 
 In standalone mode, tokens are automatically refreshed. 
-Tokens will at the _earliest_ automatically be renewed 5 minutes before they expire.
+Tokens will at the _earliest_ automatically be renewed 30 seconds before they expire.
 If the token already _has_ expired, a refresh attempt is still automatically triggered as long as the session itself not has ended or is marked as inactive.
 
 Automatic refreshes happens whenever the end-user visits or requests any path that is proxied to the upstream application.

pkg/session/data.go

@@ -14,7 +14,7 @@ import (
 
 const (
 	RefreshMinInterval = 1 * time.Minute
-	RefreshLeeway      = 5 * time.Minute
+	RefreshLeeway      = 30 * time.Second
 )
 
 type EncryptedData struct {

pkg/session/data_test.go

@@ -195,7 +195,7 @@ func TestMetadata_ShouldRefresh(t *testing.T) {
 		metadata := session.Metadata{
 			Tokens: session.MetadataTokens{
 				RefreshedAt: time.Now().Add(-5 * time.Minute),
-				ExpireAt:    time.Now().Add(time.Minute),
+				ExpireAt:    time.Now().Add(15 * time.Second),
 			},
 		}
 
@@ -273,7 +273,7 @@ func TestMetadata_ShouldRefresh(t *testing.T) {
 			},
 			Tokens: session.MetadataTokens{
 				RefreshedAt: time.Now().Add(-5 * time.Minute),
-				ExpireAt:    time.Now().Add(time.Minute),
+				ExpireAt:    time.Now().Add(15 * time.Second),
 			},
 		}