feat: ensure OAuth2 refresh tokens outlive access tokens (#19769)

cli/server.go

@@ -350,6 +350,11 @@ func (r *RootCmd) Server(newAPI func(context.Context, *coderd.Options) (*coderd.
 				return xerrors.Errorf("access-url must include a scheme (e.g. 'http://' or 'https://)")
 			}
 
+			// Cross-field configuration validation after initial parsing.
+			if err := vals.Validate(); err != nil {
+				return err
+			}
+
 			// Disable rate limits if the `--dangerous-disable-rate-limits` flag
 			// was specified.
 			loginRateLimit := 60

cli/testdata/coder_server_--help.golden

@@ -25,6 +25,10 @@ OPTIONS:
           systemd. This directory is NOT safe to be configured as a shared
           directory across coderd/provisionerd replicas.
 
+      --default-oauth-refresh-lifetime duration, $CODER_DEFAULT_OAUTH_REFRESH_LIFETIME (default: 720h0m0s)
+          The default lifetime duration for OAuth2 refresh tokens. This controls
+          how long refresh tokens remain valid after issuance or rotation.
+
       --default-token-lifetime duration, $CODER_DEFAULT_TOKEN_LIFETIME (default: 168h0m0s)
           The default lifetime duration for API tokens. This value is used when
           creating a token without specifying a duration, such as when

cli/testdata/server-config.yaml.golden

@@ -454,6 +454,10 @@ updateCheck: false
 # IDE plugin.
 # (default: 168h0m0s, type: duration)
 defaultTokenLifetime: 168h0m0s
+# The default lifetime duration for OAuth2 refresh tokens. This controls how long
+# refresh tokens remain valid after issuance or rotation.
+# (default: 720h0m0s, type: duration)
+defaultOAuthRefreshLifetime: 720h0m0s
 # Expose the swagger endpoint via /swagger.
 # (default: <unset>, type: bool)
 enableSwagger: false

cli/vpndaemon_darwin.go

@@ -10,7 +10,7 @@ import (
 	"github.com/coder/serpent"
 )
 
-func (r *RootCmd) vpnDaemonRun() *serpent.Command {
+func (*RootCmd) vpnDaemonRun() *serpent.Command {
 	var (
 		rpcReadFD  int64
 		rpcWriteFD int64