astronomer / astro-cli / 39057529384

45%

push

github

Store an ASTRO_API_TOKEN login's real expiry, and only after the token is accepted (#2217)

* Fix ASTRO_API_TOKEN context expiry set ~57 years out instead of ~1 year

setup.go passed SetExpiresIn a Unix timestamp (time.Now().AddDate(1,0,0).Unix(),
~1.8 billion) while SetExpiresIn treated its argument as a count of seconds to
add to now. The result: contexts written by ASTRO_API_TOKEN got an expiry
around year 2083 and were never treated as expired, so refresh/re-auth never
triggered.

SetExpiresIn now takes a time.Duration instead of a bare int64, so the unit is
part of the type and this mistake can't be expressed again. Converted its four
callers (setup.go's token-refresh and API-key paths, cloud/auth's OAuth
result handler, and the ASTRO_API_TOKEN path, which now passes
365 * 24 * time.Hour) plus the three test call sites. Added a test that
asserts the ASTRO_API_TOKEN path's stored expiry lands within an hour of one
year out, not decades.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Store an ASTRO_API_TOKEN's own expiry, and only once the token is accepted

Reworks this PR after a code review. The bug stands: checkAPIToken
passed a Unix timestamp to SetExpiresIn, which takes seconds from now,
so the stored expiry landed decades out. But the fix here was not
enough, and its API change caused trouble of its own:

- checkAPIToken wrote the token and its expiry before parsing it, so a
  value that was not an API token, or one that had expired, replaced
  the context's working login; and it always stored a year, whatever
  the token's own expiry. The token stays in the context after
  ASTRO_API_TOKEN is unset, and its expiry is what sends the user back
  to log in, so a 7-day token stored as a year kept failing with 401
  instead. It now checks the claims first, then stores the token and
  its own expiry, or a year (AddDate) for one that names none, as v2
  does.
- SetExpiresIn keeps its int64 seconds: as time.Duration, a bare
  SetExpiresI... (continued)

12 of 16 new or added lines in 2 files covered. (75.0%)

27242 of 60401 relevant lines covered (45.1%)

9.84 hits per line