Skip to content

Commit 72b8cba

Browse files
aarmamaarmam
committed
feat: extend latest and session related consents
1 parent 00100a1 commit 72b8cba

File tree

6 files changed

+300
-2
lines changed

6 files changed

+300
-2
lines changed

‎consent/handler.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -579,6 +579,13 @@ func (h *Handler) AcceptConsentRequest(w http.ResponseWriter, r *http.Request, p
579579
h.r.Writer().WriteError(w, r, errorsx.WithStack(err))
580580
return
581581
} else if hr.Skip {
582+
if p.Remember && p.RememberFor > 0 { // TODO: Consider removing 'p.RememberFor > 0' to update consent validity in both ways (limited (RememberFor > 0) -> indefinitely (RememberFor = 0) and vice versa)
583+
err = h.r.ConsentManager().ExtendConsentRequest(r.Context(), h.r.ScopeStrategy(), hr, p.RememberFor)
584+
if err != nil {
585+
h.r.Writer().WriteError(w, r, errorsx.WithStack(err))
586+
return
587+
}
588+
}
582589
p.Remember = false
583590
}
584591

‎consent/handler_test.go‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,14 @@
2121
package consent_test
2222

2323
import (
24+
"bytes"
2425
"context"
2526
"encoding/json"
2627
"fmt"
2728
"net/http"
2829
"net/http/httptest"
2930
"testing"
31+
"time"
3032

3133
"github.com/ory/hydra/x"
3234

@@ -213,3 +215,72 @@ func TestGetConsentRequest(t *testing.T) {
213215
})
214216
}
215217
}
218+
219+
func TestAcceptConsentRequest(t *testing.T) {
220+
t.Run("case=extend consent expiry time", func(t *testing.T) {
221+
conf := internal.NewConfigurationWithDefaults()
222+
reg := internal.NewRegistryMemory(t, conf)
223+
h := NewHandler(reg, conf)
224+
r := x.NewRouterAdmin()
225+
h.SetRoutes(r)
226+
ts := httptest.NewServer(r)
227+
defer ts.Close()
228+
c := &http.Client{}
229+
cl := &client.Client{OutfacingID: "client-1"}
230+
require.NoError(t, reg.ClientManager().CreateClient(context.Background(), cl))
231+
232+
var initialRememberFor time.Duration = 300
233+
var remainingValidTime time.Duration = 100
234+
235+
require.NoError(t, reg.ConsentManager().CreateLoginSession(context.Background(), &LoginSession{
236+
ID: "session-1",
237+
Subject: "subject-1",
238+
}))
239+
require.NoError(t, reg.ConsentManager().CreateConsentRequest(context.Background(), &ConsentRequest{
240+
Subject: "subject-1",
241+
Client: cl,
242+
ID: "challenge-1",
243+
LoginSessionID: "session-1",
244+
Skip: false,
245+
}))
246+
requestedTimeInPast := time.Now().UTC().Add(-(initialRememberFor - remainingValidTime) * time.Second)
247+
_, err := reg.ConsentManager().HandleConsentRequest(context.Background(), "challenge-1", &HandledConsentRequest{
248+
ID: "challenge-1",
249+
Remember: true,
250+
RememberFor: int(initialRememberFor),
251+
RequestedAt: requestedTimeInPast,
252+
WasHandled: true,
253+
})
254+
require.NoError(t, err)
255+
require.NoError(t, reg.ConsentManager().CreateConsentRequest(context.Background(), &ConsentRequest{
256+
Subject: "subject-1",
257+
Client: cl,
258+
ID: "challenge-2",
259+
LoginSessionID: "session-1",
260+
RequestedAt: time.Now().UTC(),
261+
Skip: true,
262+
}))
263+
264+
var b bytes.Buffer
265+
var extendRememberFor time.Duration = 300
266+
require.NoError(t, json.NewEncoder(&b).Encode(&HandledConsentRequest{
267+
Remember: true,
268+
RememberFor: int(extendRememberFor),
269+
}))
270+
271+
req, err := http.NewRequest("PUT", ts.URL+ConsentPath+"/accept?challenge=challenge-2", &b)
272+
273+
require.NoError(t, err)
274+
resp, err := c.Do(req)
275+
require.NoError(t, err)
276+
require.EqualValues(t, 200, resp.StatusCode)
277+
crs, err := reg.ConsentManager().FindSubjectsGrantedConsentRequests(context.Background(), "subject-1", 100, 0)
278+
require.NoError(t, err)
279+
require.NotNil(t, crs)
280+
require.EqualValues(t, 1, len(crs))
281+
expectedRememberFor := int(initialRememberFor + extendRememberFor - remainingValidTime)
282+
cr := crs[0]
283+
require.EqualValues(t, "challenge-1", cr.ID)
284+
require.InDelta(t, expectedRememberFor, cr.RememberFor, 1)
285+
})
286+
}

‎consent/manager.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ import (
2424
"context"
2525
"time"
2626

27+
"github.com/ory/fosite"
28+
2729
"github.com/ory/hydra/client"
2830
)
2931

@@ -41,6 +43,7 @@ type Manager interface {
4143
CreateConsentRequest(ctx context.Context, req *ConsentRequest) error
4244
GetConsentRequest(ctx context.Context, challenge string) (*ConsentRequest, error)
4345
HandleConsentRequest(ctx context.Context, challenge string, r *HandledConsentRequest) (*ConsentRequest, error)
46+
ExtendConsentRequest(ctx context.Context, scopeStrategy fosite.ScopeStrategy, cr *ConsentRequest, extendBy int) error
4447
RevokeSubjectConsentSession(ctx context.Context, user string) error
4548
RevokeSubjectClientConsentSession(ctx context.Context, user, client string) error
4649

‎consent/manager_test_helpers.go‎

Lines changed: 160 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,7 +258,7 @@ func SaneMockAuthRequest(t *testing.T, m Manager, ls *LoginSession, cl *client.C
258258
return c
259259
}
260260

261-
func ManagerTests(m Manager, clientManager client.Manager, fositeManager x.FositeStorer) func(t *testing.T) {
261+
func ManagerTests(m Manager, clientManager client.Manager, scopeStrategy fosite.ScopeStrategy, fositeManager x.FositeStorer) func(t *testing.T) {
262262
return func(t *testing.T) {
263263
t.Run("case=init-fks", func(t *testing.T) {
264264
for _, k := range []string{"1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "rv1", "rv2"} {
@@ -486,6 +486,165 @@ func ManagerTests(m Manager, clientManager client.Manager, fositeManager x.Fosit
486486
}
487487
})
488488

489+
t.Run("case=extend consent request", func(t *testing.T) {
490+
cl := &client.Client{OutfacingID: "client-1"}
491+
_ = clientManager.CreateClient(context.Background(), cl)
492+
consentHandler := func(subject, sessionId, challenge string, initialRememberFor, remainingValidTime time.Duration) {
493+
require.NoError(t, m.CreateLoginSession(context.Background(), &LoginSession{
494+
ID: sessionId,
495+
Subject: subject,
496+
}))
497+
require.NoError(t, m.CreateConsentRequest(context.Background(), &ConsentRequest{
498+
Client: cl,
499+
Subject: subject,
500+
ID: challenge,
501+
LoginSessionID: sqlxx.NullString(sessionId),
502+
Skip: false,
503+
RequestedAt: time.Now().UTC().Add(-initialRememberFor * time.Second),
504+
Verifier: uuid.New().String(),
505+
RequestedScope: []string{"scopea"},
506+
}))
507+
requestedTimeInPast := time.Now().UTC().Round(time.Second).Add(-(initialRememberFor - remainingValidTime) * time.Second)
508+
_, err := m.HandleConsentRequest(context.Background(), challenge, &HandledConsentRequest{
509+
ID: challenge,
510+
Remember: true,
511+
RememberFor: int(initialRememberFor),
512+
RequestedAt: requestedTimeInPast,
513+
WasHandled: true,
514+
GrantedScope: []string{"scopea"},
515+
})
516+
require.NoError(t, err)
517+
}
518+
519+
t.Run("case=extend session related and latest consent expiry times", func(t *testing.T) {
520+
var initialRememberForSession1 time.Duration = 300
521+
var remainingValidTimeSession1 time.Duration = 100
522+
var initialRememberForSession2 time.Duration = 300
523+
var remainingValidTimeSession2 time.Duration = 150
524+
subject := uuid.New().String()
525+
session1 := uuid.New().String()
526+
challenge1 := uuid.New().String()
527+
challenge2 := uuid.New().String()
528+
challenge3 := uuid.New().String()
529+
consentHandler(subject, session1, challenge1, initialRememberForSession1, remainingValidTimeSession1)
530+
consentHandler(subject, uuid.New().String(), challenge2, initialRememberForSession2, remainingValidTimeSession2)
531+
cr := &ConsentRequest{
532+
Client: cl,
533+
Subject: subject,
534+
ID: challenge3,
535+
LoginSessionID: sqlxx.NullString(session1),
536+
RequestedAt: time.Now().UTC(),
537+
Skip: true,
538+
}
539+
require.NoError(t, m.CreateConsentRequest(context.Background(), cr))
540+
var extendRememberFor time.Duration = 300
541+
_, err := m.HandleConsentRequest(context.Background(), challenge3, &HandledConsentRequest{
542+
ID: challenge3,
543+
Remember: true,
544+
RememberFor: int(extendRememberFor),
545+
WasHandled: true,
546+
RequestedAt: time.Now().UTC(),
547+
})
548+
require.NoError(t, err)
549+
require.NoError(t, m.ExtendConsentRequest(context.Background(), scopeStrategy, cr, int(extendRememberFor)))
550+
crs, err := m.FindSubjectsGrantedConsentRequests(context.Background(), subject, 100, 0)
551+
require.NoError(t, err)
552+
require.EqualValues(t, 2, len(crs))
553+
554+
cr1 := crs[1]
555+
require.EqualValues(t, challenge1, cr1.ID)
556+
expectedRememberFor1 := int(initialRememberForSession1 + extendRememberFor - remainingValidTimeSession1)
557+
require.InDelta(t, expectedRememberFor1, cr1.RememberFor, 1)
558+
559+
cr2 := crs[0]
560+
require.EqualValues(t, challenge2, cr2.ID)
561+
expectedRememberFor2 := int(initialRememberForSession2 + extendRememberFor - remainingValidTimeSession2)
562+
require.InDelta(t, expectedRememberFor2, cr2.RememberFor, 1)
563+
})
564+
565+
t.Run("case=session related consent not found", func(t *testing.T) {
566+
cr := &ConsentRequest{
567+
Client: cl,
568+
Subject: "subject-1",
569+
LoginSessionID: "session-1",
570+
}
571+
require.ErrorIs(t, m.ExtendConsentRequest(context.Background(), scopeStrategy, cr, 300), ErrNoPreviousConsentFound)
572+
})
573+
574+
t.Run("case=invalid requested scope", func(t *testing.T) {
575+
subject := uuid.New().String()
576+
session1 := uuid.New().String()
577+
challenge1 := uuid.New().String()
578+
challenge2 := uuid.New().String()
579+
580+
consentHandler(subject, session1, challenge1, 300, 100)
581+
cr := &ConsentRequest{
582+
Client: cl,
583+
Subject: subject,
584+
ID: challenge2,
585+
LoginSessionID: sqlxx.NullString(session1),
586+
RequestedAt: time.Now().UTC(),
587+
Skip: true,
588+
RequestedScope: []string{"scopeb"},
589+
Verifier: uuid.New().String(),
590+
}
591+
require.NoError(t, m.CreateConsentRequest(context.Background(), cr))
592+
var extendRememberFor time.Duration = 300
593+
_, err := m.HandleConsentRequest(context.Background(), challenge2, &HandledConsentRequest{
594+
ID: challenge2,
595+
Remember: true,
596+
RememberFor: int(extendRememberFor),
597+
WasHandled: true,
598+
RequestedAt: time.Now().UTC(),
599+
})
600+
require.NoError(t, err)
601+
602+
require.NoError(t, m.ExtendConsentRequest(context.Background(), scopeStrategy, cr, int(extendRememberFor)))
603+
604+
crs, err := m.FindSubjectsGrantedConsentRequests(context.Background(), subject, 100, 0)
605+
require.NoError(t, err)
606+
require.EqualValues(t, 1, len(crs))
607+
cr1 := crs[0]
608+
require.EqualValues(t, challenge1, cr1.ID)
609+
require.EqualValues(t, 300, cr1.RememberFor)
610+
})
611+
612+
t.Run("case=initial consent request expired", func(t *testing.T) {
613+
subject := uuid.New().String()
614+
session1 := uuid.New().String()
615+
challenge1 := uuid.New().String()
616+
challenge2 := uuid.New().String()
617+
618+
consentHandler(subject, session1, challenge1, 300, 0)
619+
time.Sleep(time.Second)
620+
621+
cr := &ConsentRequest{
622+
Client: cl,
623+
Subject: subject,
624+
ID: challenge2,
625+
LoginSessionID: sqlxx.NullString(session1),
626+
RequestedAt: time.Now().UTC(),
627+
Skip: true,
628+
Verifier: uuid.New().String(),
629+
}
630+
require.NoError(t, m.CreateConsentRequest(context.Background(), cr))
631+
var extendRememberFor time.Duration = 300
632+
_, err := m.HandleConsentRequest(context.Background(), challenge2, &HandledConsentRequest{
633+
ID: challenge2,
634+
Remember: true,
635+
RememberFor: int(extendRememberFor),
636+
WasHandled: true,
637+
RequestedAt: time.Now().UTC(),
638+
})
639+
require.NoError(t, err)
640+
641+
require.NoError(t, m.ExtendConsentRequest(context.Background(), scopeStrategy, cr, int(extendRememberFor)))
642+
643+
_, err = m.FindSubjectsGrantedConsentRequests(context.Background(), subject, 100, 0)
644+
require.Error(t, err, ErrNoPreviousConsentFound)
645+
})
646+
})
647+
489648
t.Run("case=revoke-auth-request", func(t *testing.T) {
490649
require.NoError(t, m.CreateLoginSession(context.Background(), &LoginSession{
491650
ID: "rev-session-1",

‎persistence/sql/persister_consent.go‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -194,6 +194,64 @@ func (p *Persister) HandleConsentRequest(ctx context.Context, challenge string,
194194
return p.GetConsentRequest(ctx, challenge)
195195
}
196196

197+
func (p *Persister) ExtendConsentRequest(ctx context.Context, scopeStrategy fosite.ScopeStrategy, cr *consent.ConsentRequest, extendBy int) error {
198+
return p.transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
199+
tn := consent.HandledConsentRequest{}.TableName()
200+
201+
var sessionHcr consent.HandledConsentRequest
202+
if err := c.
203+
Where(fmt.Sprintf("r.subject = ? AND r.client_id = ? AND r.login_session_id = ? AND r.skip=FALSE AND (%s.error='{}' AND %s.remember=TRUE)", tn, tn), cr.Subject, cr.ClientID, cr.LoginSessionID.String()).
204+
Join("hydra_oauth2_consent_request AS r", fmt.Sprintf("%s.challenge = r.challenge", tn)).
205+
Order(fmt.Sprintf("%s.requested_at DESC", tn)).
206+
Limit(1).
207+
First(&sessionHcr); err != nil {
208+
if errors.Is(err, sql.ErrNoRows) {
209+
return errorsx.WithStack(consent.ErrNoPreviousConsentFound)
210+
}
211+
return sqlcon.HandleError(err)
212+
}
213+
214+
var latestHcr consent.HandledConsentRequest
215+
if err := c.
216+
Where(fmt.Sprintf("r.subject = ? AND r.client_id = ? AND r.skip=FALSE AND (%s.error='{}' AND %s.remember=TRUE)", tn, tn), cr.Subject, cr.ClientID).
217+
Join("hydra_oauth2_consent_request AS r", fmt.Sprintf("%s.challenge = r.challenge", tn)).
218+
Order(fmt.Sprintf("%s.requested_at DESC", tn)).
219+
Limit(1).
220+
First(&latestHcr); err != nil {
221+
return sqlcon.HandleError(err)
222+
}
223+
224+
if err := p.extendHandledConsentRequest(ctx, cr, scopeStrategy, sessionHcr, extendBy); err != nil {
225+
return err
226+
}
227+
228+
if latestHcr.ID != sessionHcr.ID {
229+
if err := p.extendHandledConsentRequest(ctx, cr, scopeStrategy, latestHcr, extendBy); err != nil {
230+
return err
231+
}
232+
}
233+
return nil
234+
})
235+
}
236+
237+
func (p *Persister) extendHandledConsentRequest(ctx context.Context, cr *consent.ConsentRequest, scopeStrategy fosite.ScopeStrategy, hcr consent.HandledConsentRequest, extendBy int) error {
238+
for _, scope := range cr.RequestedScope {
239+
if !scopeStrategy(hcr.GrantedScope, scope) {
240+
return nil
241+
}
242+
}
243+
244+
isConsentRequestExpired := hcr.RememberFor > 0 && hcr.RequestedAt.Add(time.Duration(hcr.RememberFor)*time.Second).Before(time.Now().UTC())
245+
if isConsentRequestExpired {
246+
return nil
247+
}
248+
249+
remainingTime := hcr.RequestedAt.Unix() + int64(hcr.RememberFor) - time.Now().Unix()
250+
hcr.RememberFor = hcr.RememberFor + extendBy - int(remainingTime)
251+
252+
return sqlcon.HandleError(p.Connection(ctx).Update(&hcr))
253+
}
254+
197255
func (p *Persister) VerifyAndInvalidateConsentRequest(ctx context.Context, verifier string) (*consent.HandledConsentRequest, error) {
198256
var r consent.HandledConsentRequest
199257
return &r, p.transaction(ctx, func(ctx context.Context, c *pop.Connection) error {

‎persistence/sql/persister_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ func TestManagers(t *testing.T) {
4444
t.Run("case=update-two-clients", client.TestHelperUpdateTwoClients(k, m.ClientManager()))
4545
})
4646

47-
t.Run("package=consent/manager="+k, consent.ManagerTests(m.ConsentManager(), m.ClientManager(), m.OAuth2Storage()))
47+
t.Run("package=consent/manager="+k, consent.ManagerTests(m.ConsentManager(), m.ClientManager(), m.ScopeStrategy(), m.OAuth2Storage()))
4848

4949
t.Run("package=consent/janitor="+k, testhelpers.JanitorTests(m.Config(), m.ConsentManager(), m.ClientManager(), m.OAuth2Storage()))
5050

0 commit comments

Comments
 (0)