1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233
use aliri_clock::{Clock, DurationSecs, System, UnixTime};
use serde::{Deserialize, Serialize};
use super::{AccessTokenRef, IdTokenRef};
/// A token as returned by the authority with some additional lifetime information
#[derive(Debug, Serialize, Deserialize)]
pub struct TokenWithLifetime {
access_token: Box<AccessTokenRef>,
id_token: Option<Box<IdTokenRef>>,
lifetime: DurationSecs,
issued: UnixTime,
stale: UnixTime,
expiry: UnixTime,
}
impl TokenWithLifetime {
pub(crate) fn clone_it(&self) -> Self {
Self {
access_token: self.access_token.to_owned().into_boxed_ref(),
id_token: self
.id_token
.as_deref()
.map(|x| (*x).to_owned().into_boxed_ref()),
lifetime: self.lifetime,
issued: self.issued,
stale: self.stale,
expiry: self.expiry,
}
}
}
/// A token's lifecycle status
#[derive(Debug)]
pub enum TokenStatus {
/// The token is fresh and valid
Fresh,
/// The token is valid, but should be refreshed
Stale,
/// The token is no longer valid
Expired,
}
impl TokenWithLifetime {
/// Gets the current access token
#[inline]
pub fn access_token(&self) -> &AccessTokenRef {
&self.access_token
}
/// Gets the current ID token, if available
#[inline]
pub fn id_token(&self) -> Option<&IdTokenRef> {
self.id_token.as_deref()
}
/// Gets the token's lifetime
#[inline]
pub fn lifetime(&self) -> DurationSecs {
self.lifetime
}
/// Gets the time that the token was issued
#[inline]
pub fn issued(&self) -> UnixTime {
self.issued
}
/// Gets the time that the token will become stale
#[inline]
pub fn stale(&self) -> UnixTime {
self.stale
}
/// Gets the time that the token will expire
#[inline]
pub fn expiry(&self) -> UnixTime {
self.expiry
}
/// Gets the interval during which the token should be considered fresh
#[inline]
pub fn fresh_interval(&self) -> std::ops::Range<UnixTime> {
self.issued..self.stale
}
/// Gets the interval during which the token is valid
#[inline]
pub fn valid_interval(&self) -> std::ops::Range<UnixTime> {
self.issued..self.expiry
}
/// Gets the token's current lifetime status
#[inline]
pub fn token_status(&self) -> TokenStatus {
self.token_status_with_clock(&System)
}
/// Gets the token's lifetime status based on the current time
/// as reported by the provided clock
#[inline]
pub fn token_status_with_clock<C: Clock>(&self, clock: &C) -> TokenStatus {
self.token_status_at(clock.now())
}
/// Gets the token's lifetime status as of the provided time
#[inline]
pub fn token_status_at(&self, time: UnixTime) -> TokenStatus {
if time < self.stale {
TokenStatus::Fresh
} else if time < self.expiry {
TokenStatus::Stale
} else {
TokenStatus::Expired
}
}
/// Gets a duration for how much longer the token will be fresh
#[inline]
pub fn until_stale(&self) -> DurationSecs {
self.until_stale_with_clock(&System)
}
/// Gets a duration for how much longer the token will be fresh based on the current time
/// as reported by the provided clock
#[inline]
pub fn until_stale_with_clock<C: Clock>(&self, clock: &C) -> DurationSecs {
self.until_stale_at(clock.now())
}
/// Gets a duration for how much longer the token would be fresh as of the
/// provided time
#[inline]
pub fn until_stale_at(&self, time: UnixTime) -> DurationSecs {
if time < self.stale {
self.stale - time
} else {
DurationSecs(0)
}
}
/// Gets a duration for how much longer the token will be valid
#[inline]
pub fn until_expired(&self) -> DurationSecs {
self.until_expired_with_clock(&System)
}
/// Gets a duration for how much longer the token will be valid based on the current time
/// as reported by the provided clock
#[inline]
pub fn until_expired_with_clock<C: Clock>(&self, clock: &C) -> DurationSecs {
self.until_expired_at(clock.now())
}
/// Gets a duration for how much longer the token would be valid as of the
/// provided time
#[inline]
pub fn until_expired_at(&self, time: UnixTime) -> DurationSecs {
if time < self.expiry {
self.expiry - time
} else {
DurationSecs(0)
}
}
}
/// Configuration for determining how long a token should be considered fresh
#[derive(Clone, Debug)]
pub struct TokenLifetimeConfig<C = System> {
freshness_period: f64,
min_staleness_period: DurationSecs,
clock: C,
}
impl Default for TokenLifetimeConfig {
/// Default lifetime configuration
///
/// Uses a freshness period of 75%, with a minimum stale period of 30 seconds, and using
/// the system clock.
fn default() -> Self {
Self {
freshness_period: 0.75,
min_staleness_period: DurationSecs(30),
clock: System,
}
}
}
impl TokenLifetimeConfig {
/// Constructs a new lifetime configuration
///
/// A token using this configuration will be considered stale when the `freshness_period`
/// (represented as a ratio of the token's lifetime) has passed. The token will be always
/// be considered stale with at least `min_staleness_period` remaining.
pub fn new(freshness_period: f64, min_staleness_period: DurationSecs) -> Self {
Self {
freshness_period,
min_staleness_period,
clock: System,
}
}
}
impl<C> TokenLifetimeConfig<C> {
fn time_to_stale(&self, issued: UnixTime, valid_duration: DurationSecs) -> UnixTime {
let delay = (valid_duration * self.freshness_period).max(self.min_staleness_period);
issued + delay
}
}
impl<C: Clock> TokenLifetimeConfig<C> {
/// Given an access token, id token, and token lifetime, constructs a token with a lifetime
pub fn create_token<A, I>(
&self,
access_token: A,
id_token: Option<I>,
valid_duration: DurationSecs,
) -> TokenWithLifetime
where
A: AsRef<AccessTokenRef>,
I: AsRef<IdTokenRef>,
{
let issued = self.clock.now();
TokenWithLifetime {
access_token: access_token.as_ref().to_owned().into_boxed_ref(),
id_token: id_token.map(|i| i.as_ref().to_owned().into_boxed_ref()),
lifetime: valid_duration,
issued,
stale: self.time_to_stale(issued, valid_duration),
expiry: issued + valid_duration,
}
}
}