From 03e822f8d5523a54f0d1e33d8922d0a052326800 Mon Sep 17 00:00:00 2001
From: kjh2064 <kjh2064@gmail.com>
Date: Thu, 9 Jul 2026 13:40:18 +0900
Subject: [PATCH] Persist auth keys across deployments

---
 src/TaxBaik.Web/Pages/Admin/Login.cshtml.cs | 3 ++-
 src/TaxBaik.Web/Program.cs                  | 9 +++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/TaxBaik.Web/Pages/Admin/Login.cshtml.cs b/src/TaxBaik.Web/Pages/Admin/Login.cshtml.cs
index b81f3e0..757c6c2 100644
--- a/src/TaxBaik.Web/Pages/Admin/Login.cshtml.cs
+++ b/src/TaxBaik.Web/Pages/Admin/Login.cshtml.cs
@@ -95,7 +95,8 @@ public class LoginModel(AuthService authService) : PageModel
 
         var properties = new AuthenticationProperties
         {
-            IsPersistent = false,
+            IsPersistent = true,
+            ExpiresUtc = DateTimeOffset.UtcNow.AddHours(12),
             RedirectUri = RedirectUrl
         };
 
diff --git a/src/TaxBaik.Web/Program.cs b/src/TaxBaik.Web/Program.cs
index 9178261..566e597 100644
--- a/src/TaxBaik.Web/Program.cs
+++ b/src/TaxBaik.Web/Program.cs
@@ -3,6 +3,7 @@ using System.Text;
 using System.Text.Encodings.Web;
 using System.Text.Unicode;
 using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Authentication.OAuth;
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.RateLimiting;
@@ -54,6 +55,14 @@ builder.Host.UseSerilog((context, config) =>
 builder.Services.AddAuthorization();
 builder.Services.AddProblemDetails();
 builder.Services.AddHealthChecks();
+var dataProtectionKeyPath = Path.Combine(
+    Environment.GetFolderPath(Environment.SpecialFolder.UserProfile),
+    ".taxbaik",
+    "data-protection-keys");
+Directory.CreateDirectory(dataProtectionKeyPath);
+builder.Services.AddDataProtection()
+    .SetApplicationName("TaxBaik.Web")
+    .PersistKeysToFileSystem(new DirectoryInfo(dataProtectionKeyPath));
 builder.Services.AddRateLimiter(options =>
 {
     options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;