bcgov / digital-trust-common-service / 32276083954

88%

push

github

[AU-08] Token refresh and session lifecycle (#173)

* feat(oidc): finish token refresh and session lifecycle

The half of AU-08 that AU-01 didn't already cover.

- Refresh tokens were never actually being issued. oidc-provider only
  registers the refresh_token grant when offline_access is in the scope
  allowlist (or issueRefreshToken is overridden), and we had neither, so
  the token endpoint answered unsupported_grant_type while
  rotateRefreshToken and ttl.RefreshToken sat there looking correct.
  getScopes() now forces offline_access in, with a test to keep it there.

- Session and Grant TTLs were unset and defaulting to 14 days, letting a
  login outlive its 8 hour refresh token. Session now tracks the refresh
  TTL. Grant stays at 14 days on purpose: it isn't re-saved on rotation,
  so it caps the whole refresh chain and shortening it would cut off
  valid refreshes.

- Per-client refresh TTL: new nullable oauth_client column, passed to the
  provider as extra client metadata and read by a ttl.RefreshToken
  function. NULL inherits the server default so existing clients don't get
  pinned to today's value.

- Migration 000013 promotes account_id out of the JSONB payload into an
  indexed column. The adapter interface is per-model/per-id only, with no
  way to ask for everything belonging to a user, so none of the
  account-scoped work is possible without it.

- OidcAccountSessionRepository does the account-scoped reads and deletes,
  cascading through grant_id because tokens reference the grant and never
  the session.

- SessionLimitService enforces the concurrent session cap, evicting the
  oldest. No production caller yet since there's no login flow to hook it
  into; #35 now carries that call site as an acceptance criterion.

- POST /admin/users/:id/revoke-sessions resolves the account via
  TenantUser.externalUserId and writes an audit entry. The guards still
  throw NotImplementedException so it returns 501 until #37. That fails
  closed,... (continued)

1674 of 2089 branches covered (80.13%)

Branch coverage included in aggregate %.

126 of 126 new or added lines in 18 files covered. (100.0%)

3091 of 3333 relevant lines covered (92.74%)

9.37 hits per line