Add auth token expiration

[ripzery]

Issue/Task Number: #953

Closes #953

Overview

This PR implements the authentication token expiration.

The default behavior of this feature is: the authentication token will never be expired unless the settings (:pre_auth_token_lifetime and :auth_token_lifetime) are set to the integer which more than zero.

Changes

• Added expire_at to AuthToken and PreAuthToken
• Added :pre_auth_token_lifetime in the setting to specify how long the PreAuthToken can be used.
• Added :auth_token_lifetime in the setting to specify how long the AuthToken can be used.
• Added an ability to expire either PreAuthToken or AuthToken or both.

Note: :pre_auth_token_lifetime and :auth_token_lifetime can be positive integer or 0. By set it to 0, meaning that the auth_token or pre_auth_token will never be expired.

Implementation Details

Every authenticated apis call AuthToken.authenticate. This PR adds some logic around there to check whether the authentication token's expire_at has lapsed.

So the main logic was implemented pretty much like this:

if lapsed do
  expire()
else
  refresh() 
end

That means If it has lapsed, then set expire: true, otherwise refresh the authentication token by advance an expire_at to the next pre_auth_token_lifetime or auth_token_lifetime seconds.

How to test?

1.mix do ecto.migrate, omg.server

2. Set the :auth_token_lifetime (seconds) with the second you want to wait for expire.

curl http://localhost:4000/api/admin/configuration.update \
-H "Accept: application/vnd.omisego.v1+json" \
-H "Authorization: OMGAdmin `echo -n "user_id:authentication_token" | base64`" \
-H "Content-Type: application/json" \
-d '{
  "auth_token_lifetime": 20
}' \
-w "\n" | jq

3. Open the admin panel and login

4. Try to wait for x seconds (the value you've set at the previous step) to see if the auth token is expired or keep refreshing the webpage within x seconds to see if auth token is refreshed.

Note: You can also test the PreAuthToken but it will be applied only to the/admin.login_2fa which you've to enable two-factor authentication of the user first.

Impact

This PR requires a re-seeding of the settings using mix seed --settings. The steps after a deploy are therefore:

1. mix ecto.migrate
2. mix seed --settings

[T-Dnzt]

I'm having problems with those names 😅 Can we just call it auth_token_lifetime and pre_auth_token_lifetime? more verbose, but clearer.

[T-Dnzt]

Should be expired_at

[unnawut]

Lovely! 👏👏👏❤️❤️❤️

[T-Dnzt]

Approving, but can you fix the PR description to reflect the changes you've made (name of fields, etc.). Another small thing to add to the description of the configurations would be what 0 means - it never expires, right?