feat: Refresh token expiration window

driver/config/provider.go

@@ -65,6 +65,7 @@ const (
 	KeyOAuth2LegacyErrors                        = "oauth2.include_legacy_error_fields"
 	KeyExcludeNotBeforeClaim                     = "oauth2.exclude_not_before_claim"
 	KeyAllowedTopLevelClaims                     = "oauth2.allowed_top_level_claims"
+	KeyRefreshTokenRotationGracePeriod           = "oauth2.refresh_token_rotation.grace_period"
 )
 
 const DSNMemory = "memory"
@@ -428,3 +429,7 @@ func (p *Provider) CGroupsV1AutoMaxProcsEnabled() bool {
 func (p *Provider) GrantAllClientCredentialsScopesPerDefault() bool {
 	return p.p.Bool(KeyGrantAllClientCredentialsScopesPerDefault)
 }
+
+func(p *Provider) RefreshTokenRotationGracePeriod() time.Duration {
+	return p.p.DurationF(KeyRefreshTokenRotationGracePeriod, 0)
+}

persistence/sql/migrations/2021102823235122152_add_refresh_token_used_flag.down.sql

@@ -0,0 +1 @@
+ALTER TABLE hydra_oauth2_refresh DROP COLUMN used;

persistence/sql/migrations/2021102823235122152_add_refresh_token_used_flag.up.sql

@@ -0,0 +1 @@
+ALTER TABLE hydra_oauth2_refresh ADD used bool DEFAULT false;

persistence/sql/models/models.go

@@ -0,0 +1 @@
+package models

persistence/sql/persister_oauth2.go

@@ -56,7 +56,11 @@ const (
 )
 
 func (r OAuth2RequestSQL) TableName() string {
-	return "hydra_oauth2_" + string(r.Table)
+	return r.Table.TableName()
+}
+
+func (table tableName) TableName() string {
+	return "hydra_oauth2_" + string(table)
 }
 
 func (p *Persister) sqlSchemaFromRequest(rawSignature string, r fosite.Requester, table tableName) (*OAuth2RequestSQL, error) {
@@ -67,19 +71,11 @@ func (p *Persister) sqlSchemaFromRequest(rawSignature string, r fosite.Requester
 		subject = r.GetSession().GetSubject()
 	}
 
-	session, err := json.Marshal(r.GetSession())
+	session, err := p.marshalSession(r.GetSession())
 	if err != nil {
 		return nil, errorsx.WithStack(err)
 	}
 
-	if p.config.EncryptSessionData() {
-		ciphertext, err := p.r.KeyCipher().Encrypt(session)
-		if err != nil {
-			return nil, errorsx.WithStack(err)
-		}
-		session = []byte(ciphertext)
-	}
-
 	var challenge sql.NullString
 	rr, ok := r.GetSession().(*oauth2.Session)
 	if !ok && r.GetSession() != nil {
@@ -108,6 +104,31 @@ func (p *Persister) sqlSchemaFromRequest(rawSignature string, r fosite.Requester
 	}, nil
 }
 
+func (p *Persister) marshalSession(session fosite.Session) ([]byte, error) {
+	sessionBytes, err := json.Marshal(session)
+	if err != nil {
+		return nil, err
+	}
+
+	if sessionBytes, err = p.maybeEncryptSession(sessionBytes); err != nil {
+		return nil, err
+	}
+	return sessionBytes, nil
+}
+
+// MaybeEncryptSession encrypt a session if configuration indicates it should
+func (p *Persister) maybeEncryptSession(session []byte) ([]byte, error) {
+	if !p.config.EncryptSessionData() {
+		return session, nil
+	}
+
+	ciphertext, err := p.r.KeyCipher().Encrypt(session)
+	if err != nil {
+		return nil, err
+	}
+	return []byte(ciphertext), nil
+}
+
 func (r *OAuth2RequestSQL) toRequest(ctx context.Context, session fosite.Session, p *Persister) (*fosite.Request, error) {
 	sess := r.Session
 	if !gjson.ValidBytes(sess) {
@@ -219,6 +240,30 @@ func (p *Persister) createSession(ctx context.Context, signature string, request
 	return nil
 }
 
+func (p *Persister) updateRefreshSession(ctx context.Context, requestId string, session fosite.Session, used bool) error {
+	_, ok := session.(*oauth2.Session)
+	if !ok && session != nil {
+		return errors.Errorf("Expected session to be of type *Session, but got: %T", session)
+	}
+	sessionBytes, err := p.marshalSession(session)
+	if err != nil {
+		return err
+	}
+
+	updateSql := fmt.Sprintf("UPDATE %s SET session_data = ?, used = ? WHERE request_id = ?",
+		sqlTableRefresh.TableName())
+
+	return p.transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
+		err := p.Connection(ctx).RawQuery(updateSql, sessionBytes, used, requestId).Exec()
+		if errors.Is(err, sql.ErrNoRows) {
+			return errorsx.WithStack(fosite.ErrNotFound)
+		} else if err != nil {
+			return sqlcon.HandleError(err)
+		}
+		return nil
+	})
+}
+
 func (p *Persister) findSessionBySignature(ctx context.Context, rawSignature string, session fosite.Session, table tableName) (fosite.Requester, error) {
 	rawSignature = p.hashSignature(rawSignature, table)
 
@@ -247,6 +292,31 @@ func (p *Persister) findSessionBySignature(ctx context.Context, rawSignature str
 	})
 }
 
+func (p *Persister) findRequesterBySignature(ctx context.Context, signature string, tableName tableName) (fosite.Requester, error) {
+	r := OAuth2RequestSQL{Table: tableName}
+
+	var fr fosite.Requester
+	session := new(oauth2.Session)
+
+	return fr, p.transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
+		err := p.Connection(ctx).Where("signature = ?", signature).First(&r)
+		if errors.Is(err, sql.ErrNoRows) {
+			return errorsx.WithStack(fosite.ErrNotFound)
+		} else if err != nil {
+			return sqlcon.HandleError(err)
+		} else if !r.Active {
+			fr, err = r.toRequest(ctx, session, p)
+			if err != nil {
+				return err
+			}
+			return errorsx.WithStack(fosite.ErrInactiveToken)
+		}
+
+		fr, err = r.toRequest(ctx, session, p)
+		return err
+	})
+}
+
 func (p *Persister) deleteSessionBySignature(ctx context.Context, signature string, table tableName) error {
 	signature = p.hashSignature(signature, table)
 
@@ -280,13 +350,27 @@ func (p *Persister) deactivateSessionByRequestID(ctx context.Context, id string,
 	return sqlcon.HandleError(
 		p.Connection(ctx).
 			RawQuery(
-				fmt.Sprintf("UPDATE %s SET active=false WHERE request_id=?", OAuth2RequestSQL{Table: table}.TableName()),
+				fmt.Sprintf("UPDATE %s SET active=false, used=true WHERE request_id=?", OAuth2RequestSQL{Table: table}.TableName()),
 				id,
 			).
 			Exec(),
 	)
 }
 
+func (p *Persister) getRefreshTokenUsedStatusBySignature(ctx context.Context, signature string) (bool, error) {
+	var used bool
+	return used, p.transaction(ctx, func(ctx context.Context, c *pop.Connection) error {
+		query := fmt.Sprintf("SELECT used FROM %s WHERE signature = ?", sqlTableRefresh.TableName())
+		err := p.Connection(ctx).RawQuery(query, signature).First(&used)
+		if errors.Is(err, sql.ErrNoRows) {
+			return errorsx.WithStack(fosite.ErrNotFound)
+		} else if err != nil {
+			return sqlcon.HandleError(err)
+		}
+		return err
+	})
+}
+
 func (p *Persister) CreateAuthorizeCodeSession(ctx context.Context, signature string, requester fosite.Requester) (err error) {
 	return p.createSession(ctx, signature, requester, sqlTableCode)
 }
@@ -353,8 +437,40 @@ func (p *Persister) DeletePKCERequestSession(ctx context.Context, signature stri
 	return p.deleteSessionBySignature(ctx, signature, sqlTablePKCE)
 }
 
-func (p *Persister) RevokeRefreshToken(ctx context.Context, id string) error {
-	return p.deactivateSessionByRequestID(ctx, id, sqlTableRefresh)
+func (p *Persister) RevokeRefreshToken(ctx context.Context, requestId string) error {
+	return p.deactivateSessionByRequestID(ctx, requestId, sqlTableRefresh)
+}
+
+func (p *Persister) RevokeRefreshTokenMaybeGracePeriod(ctx context.Context, requestId string, signature string) error {
+	gracePeriod := p.config.RefreshTokenRotationGracePeriod()
+	if gracePeriod <= 0 {
+		return p.RevokeRefreshToken(ctx, requestId)
+	}
+
+	var requester fosite.Requester
+	var err error
+	if requester, err = p.findRequesterBySignature(ctx, signature, sqlTableRefresh); err != nil {
+		p.l.Errorf("signature: %s not found. grace period not applied", signature)
+		return errors.WithStack(err)
+	}
+
+	var used bool
+	if used,err = p.getRefreshTokenUsedStatusBySignature(ctx, signature); err != nil {
+		p.l.Errorf("signature: %s used status not found. grace period not applied", signature)
+		return errors.WithStack(err)
+	}
+
+	if ! used {
+		session := requester.GetSession()
+		session.SetExpiresAt(fosite.RefreshToken, time.Now().UTC().Add(gracePeriod))
+		if err = p.updateRefreshSession(ctx, requestId, session, true); err != nil {
+			p.l.Errorf("failed to update session with signature: %s", signature)
+			return errors.WithStack(err)
+		}
+	} else {
+		p.l.Debugf("request_id: %s has already been used and is in the grace period", requestId)
+	}
+	return nil
 }
 
 func (p *Persister) RevokeAccessToken(ctx context.Context, id string) error {

scripts/create-migration.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# create-migration.sh is a helper script to generate sql migration files.
+# Migration file names follow the date-time naming convention established by Hydra.
+
+set -Eeo pipefail
+
+if [ -n "${DEBUG}" ]; then
+  set -x
+fi
+
+migration_dir="$( dirname "${BASH_SOURCE[0]}" )/../persistence/sql/migrations/"
+supported_dialects=(cockroach mysql postgres sqlite)
+
+if [ ! -d "$migration_dir" ]; then
+  echo "expected $migration_dir to exist"
+  exit 1
+fi
+
+function usage() {
+cat << EOF
+
+Create up and down migration files for SQLite, CockroachDB, PostgreSQL
+  $0 <migration-name> --all-dialects
+
+  --all-dialects          create a file for each supported dialect (${supported_dialects[*]})
+
+  e.g.
+    $0 add_column_to_table
+    $0 add_column_to_table --all-dialects
+EOF
+}
+
+if [ -z "${1}" ]; then
+  usage
+  exit 1
+fi
+
+if [[ ! "${1}" =~ ^[A-Za-z_]+$ ]]; then
+  echo "invalid migration name: ${1} must be only A-Z, a-z, or _"
+  usage
+  exit 1
+fi
+
+timestamp=$(date -u +%Y%m%d%H%M%S%5N)
+echo $timestamp
+
+file_prefix="${timestamp}_${1}"
+
+function create_files() {
+   dialect=$1
+   filename="${file_prefix}"
+
+   if [ ! -z "${dialect}" ]; then
+     filename="${filename}.${dialect}."
+   fi
+
+   touch "${migration_dir}${filename}.up.sql"
+   touch "${migration_dir}${filename}.down.sql"
+}
+
+if [ "${2}" == "--all-dialects" ]; then
+  for dialect in "${supported_dialects[@]}"
+  do
+    create_files $dialect
+  done
+else
+  create_files
+fi

spec/config.json

@@ -867,9 +867,23 @@
               ]
             }
           }
+        },
+        "refresh_token_rotation": {
+        "type": "object",
+        "properties": {
+          "grace_period": {
+            "description": "Configures how long a Refresh Token remains valid after it has been used.",
+            "default": "0h",
+            "allOf": [
+              {
+                "$ref": "#/definitions/duration"
+              }
+            ]
+          }
         }
       }
-    },
+    }
+  },
     "secrets": {
       "type": "object",
       "additionalProperties": false,