feat: add expiration time ms tracking

[thebrianchen]

Adding tracking for expiration in auth sessions with a default of 15mins. Updated example web app to show expiration time.

note that we still need to add functionality for letting user provide the expiration time, not included in this PR.

Pull Request Checklist

• Did you add new tests and confirm existing tests pass? (yarn test)
• Did you update relevant docs? (docs are found in the site folder, and guidelines for updating/adding docs can be found in the contribution guide)
• Do your commits follow the Conventional Commits standard?
• Does your PR title also follow the Conventional Commits standard?
• If you have a breaking change, is it correctly reflected in your commit message? (e.g. feat!: breaking change)
• Did you run lint (yarn lint:check) and fix any issues? (yarn lint:write)
• Did you follow the contribution guidelines?

---

PR-Codex overview

This PR focuses on enhancing session management and authentication in the alchemyAuth connector, including session persistence, expiration handling, and improved session state management.

Detailed summary

• Added DEFAULT_SESSION_EXPIRATION_MS constant for default expiration time.
• Implemented session duration handling in AuthClient and AuthSession.
• Enhanced alchemyAuth to persist and restore session state across page reloads.
• Updated tests to verify session restoration and expiration behavior.
• Improved session status display in the UI.

The following files were skipped due to too many changes: .cursor/rules/system-prompt.mdc, v4_v5.md

✨ Ask PR-Codex anything about this PR by commenting with /codex {your question}

[dphilipson]

This is great! Left a suggestion about naming.

I think we can do a little more in relation to expiration time, which can possibly go in a separate PR. We should also set a timer in the auth client which triggers when the session expires, disconnects the client, and emits a "disconnected" event.

I was thinking of something like the interface in the design doc, particularly the elements disconnect(), on("disconnect", handler), and isDisconnected. As mentioned, it might make sense to do all this together in a separate PR.

[dphilipson]

The comment and variable name are a bit imprecise: they make it sound like you're providing the timestamp at which the session expires, rather than the length of the session. I'd consider naming the variable either just expirationMs or maybe something like sessionDurationMs, and adjusting the comment.

(I realize the variable name already existed in the code, but I didn't notice it before and now it's becoming part of the public API so needs more attention.)

Edit: Oh whoops, I realize that what I'm describing is in fact what the variable actually does, so the naming and comment are correct. In that case, I'll say that I think it would be more intuitive to have this take the duration instead, since that's what devs are thinking in terms of in 99% of situations.

[linnall]

I agree with dphil here. My mental model was that the parameter passed into the AuthSession constructor would be called something like sessionLengthMs and it would be used to set the private element on AuthSession called expirationDateMs

[jakehobbs]

+1

[thebrianchen]

changed to sessionDurationMs

[linnall]

as mentioned on authSession.ts, can we rename this to something like sessionLengthMs? assuming that the user will be passing in their desired session length and we are responsible for then calculating the expiration date from it

[thebrianchen]

added logic to recalculate session length based on the expiration date that's deserialized