fix: set token ttl correctly in redis

Author: Panaetius

internal/db/token_repo_redis.go

@@ -42,10 +42,14 @@ func (r RedisAdapter) SetAccessToken(ctx context.Context, token models.AuthToken
 	return r.setAuthToken(ctx, token)
 }
 
-func (r RedisAdapter) SetAccessTokenExpiry(ctx context.Context, token models.AuthToken, expiresAt time.Time) error {
+func (r RedisAdapter) SetAccessTokenExpiry(ctx context.Context, token models.AuthToken, expiresAtLimit time.Time) error {
 	if token.Type != models.AccessTokenType {
 		return fmt.Errorf("token is not of the right type")
 	}
+	expiresAt := expiresAtLimit
+	if !token.ExpiresAt.IsZero() && token.ExpiresAt.Before(expiresAtLimit) {
+		expiresAt = token.ExpiresAt
+	}
 	return r.setAuthTokenExpiry(ctx, token, expiresAt)
 }
 
@@ -57,10 +61,15 @@ func (r RedisAdapter) SetRefreshToken(ctx context.Context, token models.AuthToke
 	return r.setAuthToken(ctx, token)
 }
 
-func (r RedisAdapter) SetRefreshTokenExpiry(ctx context.Context, token models.AuthToken, expiresAt time.Time) error {
+func (r RedisAdapter) SetRefreshTokenExpiry(ctx context.Context, token models.AuthToken, expiresAtLimit time.Time) error {
 	if token.Type != models.RefreshTokenType {
 		return fmt.Errorf("token is not of the right type")
 	}
+	expiresAt := expiresAtLimit
+	if !token.ExpiresAt.IsZero() && token.ExpiresAt.Before(expiresAtLimit) {
+		expiresAt = token.ExpiresAt
+	}
+	slog.Info("refresh token expiry", "limit", expiresAtLimit, "token expires", token.ExpiresAt, "expires", expiresAt, "zero", token.ExpiresAt.IsZero())
 	return r.setAuthTokenExpiry(ctx, token, expiresAt)
 }
 
@@ -71,10 +80,14 @@ func (r RedisAdapter) SetIDToken(ctx context.Context, token models.AuthToken) er
 	return r.setAuthToken(ctx, token)
 }
 
-func (r RedisAdapter) SetIDTokenExpiry(ctx context.Context, token models.AuthToken, expiresAt time.Time) error {
+func (r RedisAdapter) SetIDTokenExpiry(ctx context.Context, token models.AuthToken, expiresAtLimit time.Time) error {
 	if token.Type != models.IDTokenType {
 		return fmt.Errorf("token is not of the right type")
 	}
+	expiresAt := expiresAtLimit
+	if !token.ExpiresAt.IsZero() && token.ExpiresAt.Before(expiresAtLimit) {
+		expiresAt = token.ExpiresAt
+	}
 	return r.setAuthTokenExpiry(ctx, token, expiresAt)
 }
 
@@ -155,15 +168,20 @@ func (r RedisAdapter) setAuthToken(ctx context.Context, token models.AuthToken)
 }
 
 func (r RedisAdapter) setAuthTokenExpiry(ctx context.Context, token models.AuthToken, expiresAt time.Time) error {
+	slog.Info("refresh token expiry 1")
 	err := validateTokenType(token.Type)
+	slog.Info("refresh token expiry 2", "err", err)
 	if err != nil {
 		return err
 	}
 
 	key := r.getTokenKey(token)
+	slog.Info("refresh token expiry 3", "key", key)
 	if expiresAt.IsZero() {
+		slog.Info("refresh token expiry 4")
 		return r.rdb.Persist(ctx, key).Err()
 	}
+	slog.Info("refresh token expiry 5")
 	return r.rdb.ExpireAt(ctx, key, expiresAt.Add(tokenExpiresAtLeeway)).Err()
 }
 

internal/models/token_repository.go

@@ -24,7 +24,7 @@ type AccessTokenGetter interface {
 
 type AccessTokenSetter interface {
 	SetAccessToken(ctx context.Context, token AuthToken) error
-	SetAccessTokenExpiry(ctx context.Context, token AuthToken, expiresAt time.Time) error
+	SetAccessTokenExpiry(ctx context.Context, token AuthToken, expiresAtLimit time.Time) error
 }
 
 type AccessTokenRemover interface {
@@ -37,7 +37,7 @@ type RefreshTokenGetter interface {
 
 type RefreshTokenSetter interface {
 	SetRefreshToken(ctx context.Context, token AuthToken) error
-	SetRefreshTokenExpiry(ctx context.Context, token AuthToken, expiresAt time.Time) error
+	SetRefreshTokenExpiry(ctx context.Context, token AuthToken, expiresAtLimit time.Time) error
 }
 
 type RefreshTokenRemover interface {
@@ -50,7 +50,7 @@ type IDTokenGetter interface {
 
 type IDTokenSetter interface {
 	SetIDToken(ctx context.Context, token AuthToken) error
-	SetIDTokenExpiry(ctx context.Context, token AuthToken, expiresAt time.Time) error
+	SetIDTokenExpiry(ctx context.Context, token AuthToken, expiresAtLimit time.Time) error
 }
 
 type IDTokenRemover interface {

internal/sessions/session_maker.go

@@ -32,9 +32,9 @@ func (sm *SessionMakerImpl) NewSession() (models.Session, error) {
 	if session.IdleTTL() == time.Duration(0) {
 		session.ExpiresAt = time.Time{}
 	} else if session.MaxTTL() == time.Duration(0) {
-		session.ExpiresAt = session.CreatedAt.Add(session.MaxTTL())
-	} else {
 		session.ExpiresAt = session.CreatedAt.Add(session.IdleTTL())
+	} else {
+		session.ExpiresAt = session.CreatedAt.Add(session.MaxTTL())
 	}
 	slog.Info("NEW SESSION", "session", session)
 	return session, nil

internal/sessions/token_handling.go

@@ -135,7 +135,7 @@ func (sessions *SessionStore) SaveTokens(c echo.Context, session *models.Session
 		session.TokenIDs = models.SerializableMap{}
 	}
 	session.TokenIDs[providerID] = tokens.AccessToken.ID
-	expiresAt := sessions.getTokenStorageExpiration(tokens, *session)
+	expiresAt := sessions.getTokenStorageExpiration(*session)
 	err = sessions.tokenStore.SetAccessToken(c.Request().Context(), tokens.AccessToken)
 	if err != nil {
 		return err
@@ -175,11 +175,6 @@ func (*SessionStore) idTokenKey(tokenID string) string {
 	return IDTokenCtxKey + ":" + tokenID
 }
 
-// getTokenStorageExpiration returns the max session expiration unless the provider is Renku or GitLab, in which case there is no expiration
-func (*SessionStore) getTokenStorageExpiration(tokens models.AuthTokenSet, session models.Session) time.Time {
-	providerID := tokens.AccessToken.ProviderID
-	if providerID == "renku" || providerID == "gitlab" {
-		return time.Time{}
-	}
+func (*SessionStore) getTokenStorageExpiration(session models.Session) time.Time {
 	return session.CreatedAt.Add(session.MaxTTL())
 }