feat: enforce strict expiration checking for JWT and handle existing user identities in password strategy

apps/api/src/services/auth/authentication.rs

@@ -115,6 +115,8 @@ impl AuthenticationService for AuthenticationServiceImpl {
         target_sub: Option<String>,
     ) -> Result<Option<Claims>, ServiceError> {
         let mut validation = Validation::default();
+        // disable leeway for strict expiration checking
+        validation.leeway = 0;
         if let Some(expected_sub) = target_sub {
             validation.sub = Some(expected_sub);
         }
@@ -247,11 +249,16 @@ mod tests {
         let service = AuthenticationServiceImpl::new(Some("secret".to_string()));
 
         let user_id = Uuid::new_v4();
-        let (token, _) = service.generate_jwt(user_id, 1).await.unwrap();
+        let (token, claims) = service.generate_jwt(user_id, 1).await.unwrap();
         sleep(Duration::from_secs(2)).await;
 
         let valid = service.is_valid_jwt(&token, None).await.unwrap();
-        assert!(valid.is_none(), "Token should be expired and thus invalid");
+        assert!(
+            valid.is_none(),
+            "Token should be expired and thus invalid. Current time: {:?}. Diff: {}",
+            chrono::Utc::now(),
+            chrono::Utc::now().timestamp() - claims.exp as i64
+        );
     }
 
     #[tokio::test]