improved session timeout config, new error handling code in UI

If the FHIR servers answers with a redirect to the OIDC provider due to
an invalidated session Task resources to be created and
QuestionnaireResponse resource to be updated are stored in the browsers
session storage. After the redirect returns from the OIDC provider input
elements are pre-filled from the stored resources and the send button
scrolled into view. The send button blinks twice to get the users
attention.

Author: hhund

dsf-common/dsf-common-jetty/src/main/java/dev/dsf/common/config/AbstractJettyConfig.java

@@ -212,6 +212,10 @@ public abstract class AbstractJettyConfig extends AbstractCertificateConfig
 	@Value("${dev.dsf.server.auth.oidc.back.channel.logout.path:/back-channel-logout}")
 	private String oidcBackChannelPath;
 
+	@Documentation(description = "Maximum inactivity period after which the server session for OIDC logins is invalidated; the access token may expire earlier, resulting in earlier session invalidation")
+	@Value("${dev.dsf.server.auth.oidc.session.timeout:PT30M}")
+	private String oidcSessionTimeout;
+
 	@Documentation(description = "Forward (http/https) proxy url, use *DEV_DSF_BPE_PROXY_NOPROXY* to list domains that do not require a forward proxy", example = "http://proxy.foo:8080")
 	@Value("${dev.dsf.proxy.url:#{null}}")
 	private String proxyUrl;
@@ -318,6 +322,7 @@ private void configureSecurityHandler(WebAppContext webAppContext, Supplier<Inte
 	{
 		SessionHandler sessionHandler = webAppContext.getSessionHandler();
 		sessionHandler.setSameSite(SameSite.LAX);
+		sessionHandler.setMaxInactiveInterval(oidcSessionTimeout());
 
 		SessionCookieConfig sessionCookieConfig = sessionHandler.getSessionCookieConfig();
 		sessionCookieConfig.setSecure(true);
@@ -334,7 +339,7 @@ private void configureSecurityHandler(WebAppContext webAppContext, Supplier<Inte
 		if (oidcAuthorizationCodeFlowEnabled || oidcBearerTokenEnabled || oidcBackChannelLogoutEnabled)
 		{
 			openIdConfiguration = new OpenIdConfiguration.Builder(oidcProviderRealmBaseUrl, oidcClientId,
-					oidcClientSecret).httpClient(createOidcClient()).build();
+					oidcClientSecret).logoutWhenIdTokenIsExpired(true).httpClient(createOidcClient()).build();
 
 			if (oidcAuthorizationCodeFlowEnabled)
 			{
@@ -441,20 +446,26 @@ private Duration getOidcProviderClientCacheJwksResourceTimeout()
 		return assertPositive(Duration.parse(oidcProviderClientCacheJwksResourceTimeout));
 	}
 
-	@Bean
-	@Lazy
-	public Duration oidcProviderClientTimeoutRead()
+	private Duration oidcProviderClientTimeoutRead()
 	{
 		return assertPositive(Duration.parse(oidcProviderClientTimeoutRead));
 	}
 
-	@Bean
-	@Lazy
-	public Duration oidcProviderClientTimeoutConnect()
+	private Duration oidcProviderClientTimeoutConnect()
 	{
 		return assertPositive(Duration.parse(oidcProviderClientTimeoutConnect));
 	}
 
+	private int oidcSessionTimeout()
+	{
+		long seconds = assertPositive(Duration.parse(oidcSessionTimeout)).getSeconds();
+
+		if (seconds >= Integer.MAX_VALUE)
+			seconds = Integer.MAX_VALUE;
+
+		return (int) seconds;
+	}
+
 	private Duration assertPositive(Duration duration)
 	{
 		if (duration != null && duration.isNegative())

dsf-fhir/dsf-fhir-server/src/main/resources/fhir/static/form.css

@@ -255,15 +255,25 @@ input[type=number] {
 }
 
 button.submit {
-	background-color: #326F95;
-	color: #fff;
+	background-color: var(--color-prime);
+	color: var(--color-background);
 	padding: 12px 60px;
 	border: none;
 	border-radius: 4px;
 	cursor: pointer;
 	float: left;
 }
 
+@keyframes button-blink-red {
+	0%  { background-color: var(--color-info-red); color: var(--color-info-background-red); }
+	33.3%  { background-color: var(--color-prime); color: var(--color-background); }
+	66.6%  { background-color: var(--color-info-red); color: var(--color-info-background-red); }
+}
+
+.button-blink {
+	animation: button-blink-red 0.7s steps(1);
+}
+
 .spinner-enabled {
 	display: block;
 }