mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-08 15:41:15 +02:00
Chris Lu
23d424248d
* sts: session duration no longer clamped to the web identity token exp The assumed-role session lifetime is governed by DurationSeconds and the configured tokenDuration/maxSessionLength, matching AWS. Clamping to the already-verified token's exp made short-lived id_tokens (GitLab issues ~2-minute ones) yield unusable sessions regardless of configuration. Claude-Session: https://claude.ai/code/session_01XH7iM88ZqWMEvsLB8tkWPQ * sts: cover session duration against short-lived web identity tokens The mock OIDC provider now carries the token exp through to the identity like the real provider, so the integration test would catch the clamp. Claude-Session: https://claude.ai/code/session_01XH7iM88ZqWMEvsLB8tkWPQ
39 lines
1009 B
Go
39 lines
1009 B
Go
package sts
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestCalculateSessionDuration(t *testing.T) {
|
|
svc := NewSTSService()
|
|
if err := svc.Initialize(&STSConfig{
|
|
TokenDuration: FlexibleDuration{time.Hour},
|
|
MaxSessionLength: FlexibleDuration{12 * time.Hour},
|
|
Issuer: "test-issuer",
|
|
SigningKey: []byte("test-signing-key-at-least-32-bytes-long"),
|
|
}); err != nil {
|
|
t.Fatalf("Initialize() error = %v", err)
|
|
}
|
|
|
|
seconds := func(v int64) *int64 { return &v }
|
|
|
|
tests := []struct {
|
|
name string
|
|
durationSeconds *int64
|
|
want time.Duration
|
|
}{
|
|
{"default from config", nil, time.Hour},
|
|
{"explicit request", seconds(1800), 30 * time.Minute},
|
|
{"capped at MaxSessionLength", seconds(86400), 12 * time.Hour},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
if got := svc.calculateSessionDuration(tc.durationSeconds); got != tc.want {
|
|
t.Errorf("calculateSessionDuration(%v) = %v, want %v", tc.durationSeconds, got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|