refactor(tokens): derive expiry ceilings and defaults from the global strategy

The global expiry config traveled through server.Config three times: as
the parsed RefreshTokenPolicy, again re-parsed into ExpiryCeilings, and
a third time as raw strings in RefreshTokenDefaults. NewExpiryPolicy now
derives the ceilings and the inheritance roots from the strategy itself,
so both exported types, both Config fields, buildExpiryCeilings and the
discard-logger string round-trip all disappear.

The two validations it hosted move where they belong: a non-positive
idTokens value is rejected where it is parsed, and negative refresh
durations are rejected in NewRefreshTokenPolicy — which also covers the
pre-existing case of a negative global instantly expiring every token.
NewRefreshTokenPolicy returns to its original signature; the injected
clock reaches override strategies through NewExpiryPolicy alone.

Claude-Session: https://claude.ai/code/session_0144Jv4MhGfwhx67R3G6qqrC
Signed-off-by: Helio Machado <0x2b3bfa0+git@googlemail.com>

Author: 0x2b3bfa0

cmd/dex/serve.go

@@ -317,6 +317,11 @@ func runServe(options serveOptions) error {
 		if err != nil {
 			return fmt.Errorf("invalid config value %q for id token expiry: %v", c.Expiry.IDTokens, err)
 		}
+		// The value doubles as the ceiling on per-connector overrides, where
+		// 0 would read as "no ceiling".
+		if idTokensValidFor <= 0 {
+			return fmt.Errorf("invalid config value %q for id token expiry: must be positive", c.Expiry.IDTokens)
+		}
 		logger.Info("config id tokens", "valid_for", idTokensValidFor)
 	}
 
@@ -417,26 +422,13 @@ func runServe(options serveOptions) error {
 		c.Expiry.RefreshTokens.ValidIfNotUsedFor,
 		c.Expiry.RefreshTokens.AbsoluteLifetime,
 		c.Expiry.RefreshTokens.ReuseInterval,
-		time.Now,
 	)
 	if err != nil {
 		return fmt.Errorf("invalid refresh token expiration policy config: %v", err)
 	}
 
 	serverConfig.RefreshTokenPolicy = refreshTokenPolicy
 
-	ceilings, err := buildExpiryCeilings(idTokensValidFor, c.Expiry.RefreshTokens)
-	if err != nil {
-		return fmt.Errorf("invalid global expiry config: %v", err)
-	}
-	serverConfig.ExpiryCeilings = ceilings
-	serverConfig.RefreshTokenDefaults = tokens.RefreshTokenDefaults{
-		DisableRotation:   c.Expiry.RefreshTokens.DisableRotation,
-		ValidIfNotUsedFor: c.Expiry.RefreshTokens.ValidIfNotUsedFor,
-		AbsoluteLifetime:  c.Expiry.RefreshTokens.AbsoluteLifetime,
-		ReuseInterval:     c.Expiry.RefreshTokens.ReuseInterval,
-	}
-
 	if featureflags.SessionsEnabled.Enabled() {
 		sessionConfig, err := parseSessionConfig(c.Sessions)
 		if err != nil {
@@ -868,45 +860,6 @@ func parseSessionConfig(s *Sessions) (*session.Config, error) {
 	return sc, nil
 }
 
-// buildExpiryCeilings parses the global expiry config into the ceilings used
-// to validate per-connector overrides. The server uses these for both static
-// YAML connectors at startup and dynamic API writes at runtime.
-func buildExpiryCeilings(globalIDTokens time.Duration, globalRefresh RefreshToken) (tokens.ExpiryCeilings, error) {
-	// A ceiling of 0 means "no ceiling"; reject values that would silently
-	// disable enforcement.
-	if globalIDTokens <= 0 {
-		return tokens.ExpiryCeilings{}, fmt.Errorf("expiry.idTokens must be positive, got %v", globalIDTokens)
-	}
-	c := tokens.ExpiryCeilings{
-		IDTokens:                globalIDTokens,
-		RefreshRotationDisabled: globalRefresh.DisableRotation,
-	}
-	for _, f := range []struct {
-		name  string
-		value string
-		dst   *time.Duration
-	}{
-		{"expiry.refreshTokens.absoluteLifetime", globalRefresh.AbsoluteLifetime, &c.RefreshAbsoluteLifetime},
-		{"expiry.refreshTokens.validIfNotUsedFor", globalRefresh.ValidIfNotUsedFor, &c.RefreshValidIfNotUsedFor},
-		{"expiry.refreshTokens.reuseInterval", globalRefresh.ReuseInterval, &c.RefreshReuseInterval},
-	} {
-		if f.value == "" {
-			continue
-		}
-		d, err := time.ParseDuration(f.value)
-		if err != nil {
-			return c, fmt.Errorf("invalid config value %q for %s: %v", f.value, f.name, err)
-		}
-		// A negative value would read as "no ceiling"; zero means "no
-		// expiration" and stays legal.
-		if d < 0 {
-			return c, fmt.Errorf("%s must not be negative, got %v", f.name, d)
-		}
-		*f.dst = d
-	}
-	return c, nil
-}
-
 func buildMFAProviders(authenticators []MFAAuthenticator, issuerURL string, logger *slog.Logger) map[string]mfa.Provider {
 	if len(authenticators) == 0 {
 		return nil

cmd/dex/serve_test.go

@@ -3,12 +3,9 @@ package main
 import (
 	"log/slog"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/dexidp/dex/server/tokens"
 )
 
 func TestNewLogger(t *testing.T) {
@@ -32,80 +29,6 @@ func TestNewLogger(t *testing.T) {
 	})
 }
 
-func TestBuildExpiryCeilings(t *testing.T) {
-	tests := []struct {
-		name            string
-		idTokens        time.Duration
-		refresh         RefreshToken
-		want            tokens.ExpiryCeilings
-		wantErrContains string
-	}{
-		{
-			name:     "all fields set",
-			idTokens: 24 * time.Hour,
-			refresh: RefreshToken{
-				AbsoluteLifetime:  "100h",
-				ValidIfNotUsedFor: "24h",
-				ReuseInterval:     "3s",
-			},
-			want: tokens.ExpiryCeilings{
-				IDTokens:                 24 * time.Hour,
-				RefreshAbsoluteLifetime:  100 * time.Hour,
-				RefreshValidIfNotUsedFor: 24 * time.Hour,
-				RefreshReuseInterval:     3 * time.Second,
-			},
-		},
-		{
-			name:     "refresh unset",
-			idTokens: 24 * time.Hour,
-			want:     tokens.ExpiryCeilings{IDTokens: 24 * time.Hour},
-		},
-		{
-			name:     "rotation disabled propagates",
-			idTokens: 24 * time.Hour,
-			refresh:  RefreshToken{DisableRotation: true},
-			want: tokens.ExpiryCeilings{
-				IDTokens:                24 * time.Hour,
-				RefreshRotationDisabled: true,
-			},
-		},
-		{
-			name:            "invalid duration",
-			idTokens:        24 * time.Hour,
-			refresh:         RefreshToken{AbsoluteLifetime: "not-a-duration"},
-			wantErrContains: `invalid config value "not-a-duration" for expiry.refreshTokens.absoluteLifetime`,
-		},
-		{
-			name:            "negative duration",
-			idTokens:        24 * time.Hour,
-			refresh:         RefreshToken{ValidIfNotUsedFor: "-1h"},
-			wantErrContains: "expiry.refreshTokens.validIfNotUsedFor must not be negative",
-		},
-		{
-			name:            "zero idTokens",
-			idTokens:        0,
-			wantErrContains: "expiry.idTokens must be positive",
-		},
-		{
-			name:            "negative idTokens",
-			idTokens:        -time.Hour,
-			wantErrContains: "expiry.idTokens must be positive",
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got, err := buildExpiryCeilings(tc.idTokens, tc.refresh)
-			if tc.wantErrContains != "" {
-				require.Error(t, err)
-				require.Contains(t, err.Error(), tc.wantErrContains)
-				return
-			}
-			require.NoError(t, err)
-			require.Equal(t, tc.want, got)
-		})
-	}
-}
-
 func TestToStorageConnectorCarriesExpiry(t *testing.T) {
 	disable := true
 	sc, err := ToStorageConnector(Connector{

server/apiserver/api_test.go

@@ -499,7 +499,7 @@ func TestCreateConnectorExpiryHierarchy(t *testing.T) {
 	logger := newLogger(t)
 	s := memory.New(logger)
 
-	expiry := tokens.NewExpiryPolicy(time.Hour, nil, tokens.ExpiryCeilings{IDTokens: time.Hour}, tokens.RefreshTokenDefaults{}, nil)
+	expiry := tokens.NewExpiryPolicy(time.Hour, nil, nil)
 	client := newAPIWithExpiry(t, s, logger, expiry)
 	defer client.Close()
 

server/authflow/handler_test.go

@@ -104,7 +104,7 @@ func newTestHandler(t *testing.T, updateConfig func(c *testFlowConfig)) (*httpte
 
 	now := func() time.Time { return time.Now() }
 	conns := connectors.NewCache(store, testResolveConnector)
-	issuer := tokens.NewIssuer(store, sig, *issuerURL, tokens.NewExpiryPolicy(24*time.Hour, nil, tokens.ExpiryCeilings{}, tokens.RefreshTokenDefaults{}, now), now, logger)
+	issuer := tokens.NewIssuer(store, sig, *issuerURL, tokens.NewExpiryPolicy(24*time.Hour, nil, now), now, logger)
 
 	tc := testFlowConfig{
 		Handler: Handler{

server/config.go

@@ -67,17 +67,10 @@ type Config struct {
 	AuthRequestsValidFor   time.Duration // Defaults to 24 hours
 	DeviceRequestsValidFor time.Duration // Defaults to 5 minutes
 
-	// Refresh token expiration settings
+	// Refresh token expiration settings. Also the ceiling per-connector expiry
+	// overrides may not loosen.
 	RefreshTokenPolicy *tokens.RefreshStrategy
 
-	// ExpiryCeilings define the upper bounds against which per-connector
-	// expiry overrides are validated. A zero duration means "no ceiling".
-	ExpiryCeilings tokens.ExpiryCeilings
-
-	// RefreshTokenDefaults provide the inheritance roots for per-connector
-	// refresh-token overrides that leave fields unset.
-	RefreshTokenDefaults tokens.RefreshTokenDefaults
-
 	// If set, the server will use this connector to handle password grants
 	PasswordConnector string
 

server/introspection/introspection_test.go

@@ -46,7 +46,7 @@ func testAccessToken(t *testing.T) string {
 	issURL, err := url.Parse(testIssuer)
 	require.NoError(t, err)
 
-	issuer := tokens.NewIssuer(memory.New(logger), sig, *issURL, tokens.NewExpiryPolicy(time.Hour, nil, tokens.ExpiryCeilings{}, tokens.RefreshTokenDefaults{}, nil), time.Now, logger)
+	issuer := tokens.NewIssuer(memory.New(logger), sig, *issURL, tokens.NewExpiryPolicy(time.Hour, nil, nil), time.Now, logger)
 	token, _, err := issuer.SignIDToken(ctx, tokens.Authorization{
 		Client:      storage.Client{ID: "test"},
 		Claims:      storage.Claims{UserID: "1", Username: "jane"},

server/server.go

@@ -104,7 +104,7 @@ func newServer(ctx context.Context, c Config) (*Server, error) {
 		templates: rc.templates,
 		logger:    c.Logger,
 	}
-	s.expiryPolicy = tokens.NewExpiryPolicy(rc.idTokensValidFor, c.RefreshTokenPolicy, c.ExpiryCeilings, c.RefreshTokenDefaults, rc.now)
+	s.expiryPolicy = tokens.NewExpiryPolicy(rc.idTokensValidFor, c.RefreshTokenPolicy, rc.now)
 	s.sessions = &session.Manager{
 		Storage:   s.storage,
 		Config:    c.SessionConfig,

server/server_oauth2_test.go

@@ -181,7 +181,7 @@ func TestNewIDTokenUsesStoredAlgorithmUntilNextRotation(t *testing.T) {
 	require.NoError(t, err)
 
 	clock := func() time.Time { return now }
-	issuer := tokens.NewIssuer(store, sig, *issuerURL, tokens.NewExpiryPolicy(time.Hour, nil, tokens.ExpiryCeilings{}, tokens.RefreshTokenDefaults{}, clock), clock, logger)
+	issuer := tokens.NewIssuer(store, sig, *issuerURL, tokens.NewExpiryPolicy(time.Hour, nil, clock), clock, logger)
 
 	accessToken := "test-access-token"
 	code := "test-auth-code"
@@ -261,7 +261,7 @@ func TestNewIDTokenContainsJTI(t *testing.T) {
 	require.NoError(t, err)
 
 	clock := func() time.Time { return now }
-	issuer := tokens.NewIssuer(store, sig, *issuerURL, tokens.NewExpiryPolicy(time.Hour, nil, tokens.ExpiryCeilings{}, tokens.RefreshTokenDefaults{}, clock), clock, logger)
+	issuer := tokens.NewIssuer(store, sig, *issuerURL, tokens.NewExpiryPolicy(time.Hour, nil, clock), clock, logger)
 
 	keys, err := sig.ValidationKeys(ctx)
 	require.NoError(t, err)