From dd3d25a5aef23a1d7639947cdead3f599ac9f3f8 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Thu, 19 May 2022 21:07:59 +0200 Subject: [PATCH] Deprecate/remove AUTH_JWT_EXPIRY JWT expiration is now controled via AUTH_OAUTH2_ACCESS_TOKEN_LIFETIME --- .env.example | 6 ------ app/boot_levels.go | 7 ++++++- app/options/auth.cue | 8 -------- auth/commands/commands.go | 2 +- pkg/options/options.gen.go | 2 -- tests/helpers/app.go | 2 -- 6 files changed, 7 insertions(+), 20 deletions(-) diff --git a/.env.example b/.env.example index f020d18d9..34d079b11 100644 --- a/.env.example +++ b/.env.example @@ -452,12 +452,6 @@ # Default: 72h # AUTH_OAUTH2_REFRESH_TOKEN_LIFETIME=72h -############################################################################### -# Expiration time for the auth JWT tokens. -# Type: time.Duration -# Default: 720h -# AUTH_JWT_EXPIRY=720h - ############################################################################### # Redirect URL to be sent with OAuth2 authentication request to provider # diff --git a/app/boot_levels.go b/app/boot_levels.go index 6e6e43b17..b10c7fddb 100644 --- a/app/boot_levels.go +++ b/app/boot_levels.go @@ -98,6 +98,11 @@ func (app *CortezaApp) Setup() (err error) { "so instead use environment variable MINIO_BUCKET, " + "we have extended it to have more flexibility over minio bucket name") } + + if _, is := os.LookupEnv("AUTH_JWT_EXPIRY"); is { + log.Warn("AUTH_JWT_EXPIRY is removed. " + + "JWT expiration value is set from AUTH_OAUTH2_ACCESS_TOKEN_LIFETIME") + } } hcd := healthcheck.Defaults() @@ -344,7 +349,7 @@ func (app *CortezaApp) InitServices(ctx context.Context) (err error) { auth.WithSecretSigner(app.Opt.Auth.Secret), // @todo implement configurable issuer claim //auth.WithDefaultIssuer(app.Opt.Auth.TokenClaimIssuer), - auth.WithDefaultExpiration(app.Opt.Auth.Expiry), + auth.WithDefaultExpiration(app.Opt.Auth.AccessTokenLifetime), auth.WithDefaultClientID(app.DefaultAuthClient.ID), auth.WithLookup(func(ctx context.Context, accessToken string) (err error) { _, err = store.LookupAuthOa2tokenByAccess(ctx, app.Store, accessToken) diff --git a/app/options/auth.cue b/app/options/auth.cue index a861679fb..a1924657e 100644 --- a/app/options/auth.cue +++ b/app/options/auth.cue @@ -58,14 +58,6 @@ auth: schema.#optionsGroup & { defaultGoExpr: "time.Hour * 24 * 3" defaultValue: "72h" } - expiry: { - type: "time.Duration" - description: "Expiration time for the auth JWT tokens." - env: "AUTH_JWT_EXPIRY" - - defaultGoExpr: "time.Hour * 24 * 30" - defaultValue: "720h" - } external_redirect_URL: { description: """ Redirect URL to be sent with OAuth2 authentication request to provider diff --git a/auth/commands/commands.go b/auth/commands/commands.go index 7fb6497ab..9e8a493b1 100644 --- a/auth/commands/commands.go +++ b/auth/commands/commands.go @@ -144,7 +144,7 @@ func Command(ctx context.Context, app serviceInitializer, storeInit func(ctx con jwtCmd.Flags().DurationVar( &tokenDuration, "duration", - app.Options().Auth.Expiry, + app.Options().Auth.AccessTokenLifetime, "Token expiry duration") testEmails := &cobra.Command{ diff --git a/pkg/options/options.gen.go b/pkg/options/options.gen.go index ed61d8544..665e48315 100644 --- a/pkg/options/options.gen.go +++ b/pkg/options/options.gen.go @@ -99,7 +99,6 @@ type ( Secret string `env:"AUTH_JWT_SECRET"` AccessTokenLifetime time.Duration `env:"AUTH_OAUTH2_ACCESS_TOKEN_LIFETIME"` RefreshTokenLifetime time.Duration `env:"AUTH_OAUTH2_REFRESH_TOKEN_LIFETIME"` - Expiry time.Duration `env:"AUTH_JWT_EXPIRY"` ExternalRedirectURL string `env:"AUTH_EXTERNAL_REDIRECT_URL"` ExternalCookieSecret string `env:"AUTH_EXTERNAL_COOKIE_SECRET"` BaseURL string `env:"AUTH_BASE_URL"` @@ -515,7 +514,6 @@ func Auth() (o *AuthOpt) { Secret: getSecretFromEnv("jwt secret"), AccessTokenLifetime: time.Hour * 2, RefreshTokenLifetime: time.Hour * 24 * 3, - Expiry: time.Hour * 24 * 30, ExternalRedirectURL: fullURL("/auth/external/{provider}/callback"), ExternalCookieSecret: getSecretFromEnv("external cookie secret"), BaseURL: fullURL("/auth"), diff --git a/tests/helpers/app.go b/tests/helpers/app.go index 776f40297..4f0e934f4 100644 --- a/tests/helpers/app.go +++ b/tests/helpers/app.go @@ -2,7 +2,6 @@ package helpers import ( "context" - "time" "github.com/cortezaproject/corteza-server/app" "github.com/cortezaproject/corteza-server/pkg/cli" @@ -30,7 +29,6 @@ func NewIntegrationTestApp(ctx context.Context, initTestServices func(*app.Corte // Create a new JWT secret (to prevent any security weirdness) a.Opt.Auth.Secret = string(rand.Bytes(32)) - a.Opt.Auth.Expiry = time.Minute a.Opt.Auth.DefaultClient = "" a.Log = logger.Default()