Limit 2FA remember duration to 90 days

.env.template

@@ -602,7 +602,7 @@
 ## Note that the checkbox would still be present, but ignored.
 # DISABLE_2FA_REMEMBER=false
 ##
-## Number of days before a remembered 2FA login expires (min: 1, max: 365).
+## Number of days before a remembered 2FA login expires (min: 1, max: 90).
 # TWO_FACTOR_REMEMBER_DAYS=30
 ##
 ## Authenticator Settings

src/config.rs

@@ -711,7 +711,7 @@ make_config! {
         /// Disable Two-Factor remember |> Enabling this would force the users to use a second factor to login every time.
         /// Note that the checkbox would still be present, but ignored.
         disable_2fa_remember:   bool,   true,   def,    false;
-        /// Two-Factor remember duration |> Number of days before a remembered Two-Factor login expires (min: 1, max: 365).
+        /// Two-Factor remember duration |> Number of days before a remembered Two-Factor login expires (min: 1, max: 90).
         two_factor_remember_days: i64,  true,   def,    30;
 
         /// Disable authenticator time drifted codes to be valid |> Enabling this only allows the current TOTP code to be valid
@@ -1234,8 +1234,8 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         err!("`INVITATION_EXPIRATION_HOURS` has a minimum duration of 1 hour")
     }
 
-    if !(1..=365).contains(&cfg.two_factor_remember_days) {
+    if !(1..=90).contains(&cfg.two_factor_remember_days) {
-        err!("`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 365 days")
+        err!("`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 90 days")
     }
 
     // Validate schedule crontab format
@@ -1853,3 +1853,25 @@ handlebars::handlebars_helper!(webver: | web_vault_version: String |
 handlebars::handlebars_helper!(vwver: | vw_version: String |
     semver::VersionReq::parse(&vw_version).expect("Invalid Vaultwarden version compare string").matches(&VW_VERSION)
 );
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn config_with_two_factor_remember_days(days: i64) -> ConfigItems {
+        ConfigBuilder {
+            database_url: Some("sqlite://:memory:".to_owned()),
+            two_factor_remember_days: Some(days),
+            ..Default::default()
+        }
+        .build()
+    }
+
+    #[test]
+    fn two_factor_remember_days_are_limited_to_ninety() {
+        assert!(validate_config(&config_with_two_factor_remember_days(90), false).is_ok());
+
+        let error = validate_config(&config_with_two_factor_remember_days(91), false).unwrap_err();
+        assert_eq!(format!("{error:?}"), "`TWO_FACTOR_REMEMBER_DAYS` must be between 1 and 90 days");
+    }
+}