Merge branch 'main' of https://git.coastit.co.za/caitlin/CRM_ENVR

next.config.ts

@@ -1,4 +1,12 @@
 import type { NextConfig } from "next"
+import crypto from "crypto"
+
+// In development, generate a random JWT secret on every server start.
+// This invalidates all previously issued JWT tokens, ensuring the user
+// must re-authenticate after each dev server restart.
+if (process.env.NODE_ENV === "development") {
+  process.env.JWT_SECRET = crypto.randomBytes(32).toString("hex")
+}
 
 const nextConfig: NextConfig = {
   eslint: {

src/lib/auth.ts

@@ -201,7 +201,6 @@ export async function createSession(userId: string, role: string) {
     secure: process.env.NODE_ENV === "production",
     sameSite: "strict",
     path: "/",
-    maxAge: 60 * 60 * 24, // 24 hours
   });
 
   return token;