feat: Clean up expired tokens

Author: joachimvh

packages/uma/config/credentials/verifiers/default.json

@@ -38,7 +38,7 @@
           "TypedVerifier:_verifiers_value": {
             "@id": "urn:uma:default:RefreshTokenVerifier",
             "@type": "RefreshTokenVerifier",
-            "refreshStore": { "@id": "urn:uma:default:RefreshTokenStore" }
+            "refreshStore": { "@id": "urn:uma:default:TokenStore" }
           }
         },
         {

packages/uma/config/dialog/negotiators/default.json

@@ -18,7 +18,7 @@
         "refreshTokenIssuer": {
           "@id": "urn:uma:default:RefreshTokenIssuer",
           "@type": "StoredRefreshTokenIssuer",
-          "refreshStore": { "@id": "urn:uma:default:RefreshTokenStore" }
+          "refreshStore": { "@id": "urn:uma:default:TokenStore" }
         }
       }
     }

packages/uma/config/routes/tokens.json

@@ -20,7 +20,7 @@
         "refreshTokenHandler": {
           "@id": "urn:uma:default:RefreshTokenHandler",
           "@type": "RefreshTokenHandler",
-          "refreshStore": { "@id": "urn:uma:default:RefreshTokenStore" },
+          "refreshStore": { "@id": "urn:uma:default:TokenStore" },
           "negotiator": { "@id": "urn:uma:default:Negotiator" }
         }
       },

packages/uma/config/tokens/storage/default.json

@@ -5,11 +5,10 @@
   "@graph": [
     {
       "@id": "urn:uma:default:TokenStore",
-      "@type": "MemoryMapStorage"
-    },
-    {
-      "@id": "urn:uma:default:RefreshTokenStore",
-      "@type": "MemoryMapStorage"
+      "@type": "WrappedExpiringStorage",
+      "source": {
+        "@type": "MemoryMapStorage"
+      }
     }
   ]
 }

packages/uma/src/tokens/JwtTokenFactory.ts

@@ -1,6 +1,7 @@
-import { BadRequestHttpError, createErrorMessage, JwkGenerator, KeyValueStorage } from '@solid/community-server';
+import { BadRequestHttpError, createErrorMessage, ExpiringStorage, JwkGenerator, } from '@solid/community-server';
 import { getLoggerFor } from 'global-logger-factory';
 import { importJWK, jwtVerify, SignJWT } from 'jose';
+import ms, { StringValue } from 'ms';
 import { randomUUID } from 'node:crypto';
 import { array, reType } from '../util/ReType';
 import { Permission } from '../views/Permission';
@@ -30,7 +31,7 @@ export class JwtTokenFactory extends TokenFactory {
   constructor(
     protected readonly keyGen: JwkGenerator,
     protected readonly issuer: string,
-    protected readonly tokenStore: KeyValueStorage<string, AccessToken>,
+    protected readonly tokenStore: ExpiringStorage<string, AccessToken>,
     protected readonly params: JwtTokenParams = { expirationTime: '30m', aud: 'solid' },
   ) {
     super();
@@ -54,9 +55,7 @@ export class JwtTokenFactory extends TokenFactory {
       .sign(jwk);
 
     this.logger.debug(`Issued new JWT Token ${JSON.stringify(token)}`);
-    // TODO: tokenstore should expire tokens eventually; can use expiring storage,
-    //       or just normal store with timer-based cleanup.
-    await this.tokenStore.set(jwt, token);
+    await this.tokenStore.set(jwt, token, ms(this.params.expirationTime as StringValue));
     return { token: jwt, tokenType: 'Bearer' };
   }
 

packages/uma/src/tokens/StoredRefreshTokenIssuer.ts

@@ -1,4 +1,4 @@
-import { KeyValueStorage } from '@solid/community-server';
+import { ExpiringStorage } from '@solid/community-server';
 import ms, { StringValue } from 'ms';
 import { randomUUID } from 'node:crypto';
 import { ClaimSet } from '../credentials/ClaimSet';
@@ -14,21 +14,19 @@ export class StoredRefreshTokenIssuer implements RefreshTokenIssuer {
   protected readonly refreshExpiration: number;
 
   public constructor(
-    protected readonly refreshStore: KeyValueStorage<string, RefreshInformation>,
+    protected readonly refreshStore: ExpiringStorage<string, RefreshInformation>,
     refreshExpiration: string = '7d',
   ) {
     this.refreshExpiration = ms(refreshExpiration as StringValue);
   }
 
   public async issue(claims: ClaimSet, permissions: Permission[]): Promise<string> {
     const refreshToken = randomUUID();
-    // TODO: expired tokens should be removed; can use expiring storage,
-    //       or just normal store with timer-based cleanup.
     await this.refreshStore.set(refreshToken, {
       claims,
       permissions,
       expiration: Date.now() + this.refreshExpiration,
-    });
+    }, this.refreshExpiration);
     return refreshToken;
   }
 }

packages/uma/test/unit/tokens/JwtTokenFactory.test.ts

@@ -1,5 +1,5 @@
-import { AlgJwk, JwkGenerator, KeyValueStorage } from '@solid/community-server';
-import { exportJWK, generateKeyPair, GenerateKeyPairResult, jwtVerify, KeyLike, SignJWT } from 'jose';
+import { AlgJwk, ExpiringStorage, JwkGenerator } from '@solid/community-server';
+import { exportJWK, generateKeyPair, GenerateKeyPairResult, jwtVerify, SignJWT } from 'jose';
 import { beforeAll, Mocked } from 'vitest';
 import { AccessToken } from '../../../src/tokens/AccessToken';
 import { JwtTokenFactory } from '../../../src/tokens/JwtTokenFactory';
@@ -32,7 +32,7 @@ describe('JwtTokenFactory', (): void => {
   };
 
   let keyGen: Mocked<JwkGenerator>;
-  let tokenStore: Mocked<KeyValueStorage<string, AccessToken>>;
+  let tokenStore: Mocked<ExpiringStorage<string, AccessToken>>;
   let factory: JwtTokenFactory;
 
   beforeAll(async(): Promise<void> => {
@@ -50,7 +50,7 @@ describe('JwtTokenFactory', (): void => {
 
     tokenStore = {
       set: vi.fn(),
-    } satisfies Partial<KeyValueStorage<string, AccessToken>> as any;
+    } satisfies Partial<ExpiringStorage<string, AccessToken>> as any;
 
     factory = new JwtTokenFactory(keyGen, issuer, tokenStore);
   });
@@ -70,7 +70,7 @@ describe('JwtTokenFactory', (): void => {
     expect(parsed.protectedHeader.alg).toBe(alg);
     expect(parsed.protectedHeader.kid).toBe(privateKey.kid);
     expect(tokenStore.set).toHaveBeenCalledTimes(1);
-    expect(tokenStore.set).toHaveBeenLastCalledWith(result.token, token);
+    expect(tokenStore.set).toHaveBeenLastCalledWith(result.token, token, 30 * 60 * 1000);
   });
 
   it('returns the permissions of the deserialized token.', async(): Promise<void> => {

packages/uma/test/unit/tokens/StoredRefreshTokenIssuer.test.ts

@@ -1,4 +1,4 @@
-import { KeyValueStorage } from '@solid/community-server';
+import { ExpiringStorage } from '@solid/community-server';
 import { Mocked } from 'vitest';
 import { RefreshInformation } from '../../../src/credentials/verify/RefreshTokenVerifier';
 import { StoredRefreshTokenIssuer } from '../../../src/tokens/StoredRefreshTokenIssuer';
@@ -14,7 +14,7 @@ describe('StoredRefreshTokenIssuer', (): void => {
   const claims = { webid: 'https://alice.example/#me' };
   const permissions = [ { resource_id: 'id', resource_scopes: [ 'scope' ] } ];
 
-  let refreshStore: Mocked<KeyValueStorage<string, RefreshInformation>>;
+  let refreshStore: Mocked<ExpiringStorage<string, RefreshInformation>>;
   let issuer: StoredRefreshTokenIssuer;
 
   beforeEach(async(): Promise<void> => {
@@ -33,7 +33,7 @@ describe('StoredRefreshTokenIssuer', (): void => {
       claims,
       permissions,
       expiration: now.getTime() + 7 * 24 * 60 * 60 * 1000,
-    });
+    }, 7 * 24 * 60 * 60 * 1000);
     expect(result).toBe('refresh-token-id');
   });
 });