fix(api): filter sessions by connector, as the request already claimed

ListAuthSessionsReq grew a connector_id field with the session rework and nothing
ever read it, so a caller asking for one connector's sessions got every one the
user had. It filters now, the example app's session view passes the connector it
is already scoped to, and the RPC comment says what the message does.

Also: several tests set a client state's AuthenticatedAt to a day in the future,
left over from mapping the old per-client ExpiresAt onto it. Nothing reads the
field today, which is exactly why it should not describe a user who authenticated
tomorrow.

Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>

Author: nabokihms

api/v2/api.proto

@@ -574,7 +574,7 @@ service Dex {
   rpc VerifyPassword(VerifyPasswordReq) returns (VerifyPasswordResp) {};
   // GetAuthSession returns an auth session by its ID.
   rpc GetAuthSession(GetAuthSessionReq) returns (GetAuthSessionResp) {};
-  // ListAuthSessions lists auth sessions, optionally filtered by user_id.
+  // ListAuthSessions lists auth sessions, optionally filtered by user and connector.
   rpc ListAuthSessions(ListAuthSessionsReq) returns (ListAuthSessionsResp) {};
   // DeleteAuthSession deletes an auth session and revokes associated refresh tokens.
   rpc DeleteAuthSession(DeleteAuthSessionReq) returns (DeleteAuthSessionResp) {};

api/v2/api_grpc.pb.go

@@ -230,7 +230,8 @@ func (s *Server) handleAdmin(w http.ResponseWriter, r *http.Request) {
 		// connector gave the user, refresh tokens under the encoded sub claim
 		// that ends up in tokens.
 		if data.UserID != "" {
-			if resp, err := s.admin.api.ListAuthSessions(ctx, &api.ListAuthSessionsReq{UserId: data.UserID}); err == nil {
+			req := &api.ListAuthSessionsReq{UserId: data.UserID, ConnectorId: data.ConnectorID}
+			if resp, err := s.admin.api.ListAuthSessions(ctx, req); err == nil {
 				for _, sess := range resp.Sessions {
 					data.Sessions = append(data.Sessions, AdminSession{
 						ID:          sess.Id,

examples/example-app/server/admin.go

@@ -891,7 +891,7 @@ func TestGetAuthSession(t *testing.T) {
 		ID:          "nonce123", Secret: "nonce123",
 		ClientStates: map[string]*storage.ClientAuthState{
 			"client-a": {
-				AuthenticatedAt:   now.Add(24 * time.Hour),
+				AuthenticatedAt:   now,
 				LastActivity:      now,
 				LastTokenIssuedAt: now,
 			},
@@ -979,6 +979,24 @@ func TestListAuthSessions(t *testing.T) {
 	if len(resp.Sessions) != 2 {
 		t.Fatalf("expected 2 sessions for user1, got %d", len(resp.Sessions))
 	}
+
+	// Filter by connector_id, and by both: one user signed in through two
+	// connectors is two sessions, and a caller may want either or one of them.
+	resp, err = client.ListAuthSessions(ctx, &api.ListAuthSessionsReq{ConnectorId: "conn1"})
+	if err != nil {
+		t.Fatalf("list auth sessions by connector: %v", err)
+	}
+	if len(resp.Sessions) != 2 {
+		t.Fatalf("expected 2 sessions on conn1, got %d", len(resp.Sessions))
+	}
+
+	resp, err = client.ListAuthSessions(ctx, &api.ListAuthSessionsReq{UserId: "user1", ConnectorId: "conn2"})
+	if err != nil {
+		t.Fatalf("list auth sessions by user and connector: %v", err)
+	}
+	if len(resp.Sessions) != 1 {
+		t.Fatalf("expected 1 session for user1 on conn2, got %d", len(resp.Sessions))
+	}
 }
 
 func TestDeleteAuthSession(t *testing.T) {

server/apiserver/api_test.go

@@ -78,6 +78,9 @@ func (d dexAPI) ListAuthSessions(ctx context.Context, req *api.ListAuthSessionsR
 		if req.UserId != "" && s.UserID != req.UserId {
 			continue
 		}
+		if req.ConnectorId != "" && s.ConnectorID != req.ConnectorId {
+			continue
+		}
 		sessions = append(sessions, storageAuthSessionToAPI(s))
 	}
 

server/apiserver/sessions.go

@@ -380,7 +380,7 @@ func TestCreateOrUpdateAuthSession(t *testing.T) {
 			ID:          nonce, Secret: nonce,
 			ClientStates: map[string]*storage.ClientAuthState{
 				"client-1": {
-					AuthenticatedAt: now.Add(24 * time.Hour),
+					AuthenticatedAt: now.Add(-10 * time.Minute),
 					LastActivity:    now.Add(-10 * time.Minute),
 				},
 			},
@@ -497,7 +497,7 @@ func setupSessionLoginFixture(t *testing.T, s *sessionTestServer) storage.AuthRe
 		ID:          "test-nonce", Secret: "test-nonce",
 		ClientStates: map[string]*storage.ClientAuthState{
 			"client-1": {
-				AuthenticatedAt: now.Add(24 * time.Hour),
+				AuthenticatedAt: now.Add(-1 * time.Minute),
 				LastActivity:    now.Add(-1 * time.Minute),
 			},
 		},
@@ -662,7 +662,7 @@ func setupSessionWithIdentity(t *testing.T, s *sessionTestServer, now time.Time,
 		ID:          nonce, Secret: nonce,
 		ClientStates: map[string]*storage.ClientAuthState{
 			"client-1": {
-				AuthenticatedAt: now.Add(24 * time.Hour),
+				AuthenticatedAt: now.Add(-1 * time.Minute),
 				LastActivity:    now.Add(-1 * time.Minute),
 			},
 		},
@@ -986,7 +986,7 @@ func TestFindSSOSession(t *testing.T) {
 			ConnectorID: "mock",
 			ClientStates: map[string]*storage.ClientAuthState{
 				"client-a": {
-					AuthenticatedAt: now.Add(24 * time.Hour),
+					AuthenticatedAt: now.Add(-5 * time.Minute),
 					LastActivity:    now.Add(-5 * time.Minute),
 				},
 			},
@@ -1011,7 +1011,7 @@ func TestFindSSOSession(t *testing.T) {
 			ConnectorID: "mock",
 			ClientStates: map[string]*storage.ClientAuthState{
 				"client-a": {
-					AuthenticatedAt: now.Add(24 * time.Hour),
+					AuthenticatedAt: now.Add(-5 * time.Minute),
 					LastActivity:    now.Add(-5 * time.Minute),
 				},
 			},
@@ -1038,7 +1038,7 @@ func TestFindSSOSession(t *testing.T) {
 			ConnectorID: "mock",
 			ClientStates: map[string]*storage.ClientAuthState{
 				"client-a": {
-					AuthenticatedAt: now.Add(24 * time.Hour),
+					AuthenticatedAt: now.Add(-5 * time.Minute),
 					LastActivity:    now.Add(-5 * time.Minute),
 				},
 			},
@@ -1071,7 +1071,7 @@ func TestTrySessionLogin_SSO(t *testing.T) {
 			ID:          "test-nonce", Secret: "test-nonce",
 			ClientStates: map[string]*storage.ClientAuthState{
 				"client-a": {
-					AuthenticatedAt: now.Add(24 * time.Hour),
+					AuthenticatedAt: now.Add(-1 * time.Minute),
 					LastActivity:    now.Add(-1 * time.Minute),
 				},
 			},
@@ -1217,7 +1217,7 @@ func TestTrySessionLogin_SSO(t *testing.T) {
 			ID:          "test-nonce", Secret: "test-nonce",
 			ClientStates: map[string]*storage.ClientAuthState{
 				"client-a": {
-					AuthenticatedAt: now.Add(24 * time.Hour),
+					AuthenticatedAt: now.Add(-1 * time.Minute),
 					LastActivity:    now.Add(-1 * time.Minute),
 				},
 			},