fix(client): use timestamp before issue token request to ensure expiresAt is smaller than token exp

[charIeszhao]

Summary

Calculate the expiresAt by requestedAt + expiresIn, which ensures the calculated result is always smaller than the actual exp property in token claims.

expiresAt = requestedAt + actual request time + expiresIn

Should fix #518

Testing

N/A

Checklist

• .changeset

[linear]

LOG-6493 ExpireAt and exp in token claims are mismatched

Discussed and decided to add a backward shifted time (60s) to the expireAt result.

[ikupenov]

Cross-posting from #518.

I don't think the expiresAt value should be calculated by using Now + expiresIn - shiftedTime but rather issueAt (iat claim) + expiresIn (or any other client-specific value that's less than expiresAt) - shiftedTime (maybe not needed). Correct me if I don't understand this right.

To summarize, I don't think it's a good idea to use Date.now() when you can use either the exp or iat claim to get a much more consistent result across the client and the server.