🐛 CreateIdentityWithPassword uses hardcoded session duration instead of configurable value

[sulthonzh]

Description

The CreateIdentityWithPassword method hardcodes the session duration to 24*time.Hour*7 (7 days), while all other session creation methods use the configurable s.sessionDuration field. This inconsistency means signup sessions bypass the configured session policy.

Context

• File: pkg/iam/auth_service.go — CreateIdentityWithPassword method
• Component: Session management

Current Behavior

session = coredata.NewRootSession(identity.ID, coredata.AuthMethodPassword, 24*time.Hour*7)

All other session creation paths use the configurable duration:

// OpenSessionWithPassword
session = coredata.NewRootSession(identity.ID, coredata.AuthMethodPassword, s.sessionDuration)

// OpenSessionWithOIDC
session = coredata.NewRootSession(identity.ID, authMethod, s.sessionDuration)

// OpenSessionWithSAML
session = coredata.NewRootSession(identityID, coredata.AuthMethodSAML, s.sessionDuration)

// OpenSessionWithMagicLink
session = coredata.NewRootSession(identity.ID, coredata.AuthMethodMagicLink, s.sessionDuration)

Expected Behavior

Signup sessions should respect s.sessionDuration like every other auth flow, allowing administrators to enforce consistent session policies.

Steps to Reproduce

1. Configure a custom session duration (e.g., 1 hour)
2. Sign up with email/password
3. Observe the session expires in 7 days instead of the configured duration
4. Login again → session correctly expires in 1 hour

Suggested Fix

- session = coredata.NewRootSession(identity.ID, coredata.AuthMethodPassword, 24*time.Hour*7)
+ session = coredata.NewRootSession(identity.ID, coredata.AuthMethodPassword, s.sessionDuration)

Impact

• Severity: Low — sessions last longer than configured policy after signup
• Who is affected: Self-hosted instances with custom session duration settings
• If an admin configures short sessions (e.g., 1 hour for compliance), new users get a 7-day session on signup

Positively — happy to submit a PR if this is welcome.