feat: Clean up expired tokens

Author: joachimvh

packages/uma/config/credentials/verifiers/default.json

@@ -38,7 +38,7 @@
           "TypedVerifier:_verifiers_value": {
             "@id": "urn:uma:default:RefreshTokenVerifier",
             "@type": "RefreshTokenVerifier",
-            "refreshStore": { "@id": "urn:uma:default:RefreshTokenStore" }
+            "refreshStore": { "@id": "urn:uma:default:TokenStore" }
           }
         },
         {

packages/uma/config/dialog/negotiators/default.json

@@ -18,7 +18,7 @@
         "refreshTokenIssuer": {
           "@id": "urn:uma:default:RefreshTokenIssuer",
           "@type": "StoredRefreshTokenIssuer",
-          "refreshStore": { "@id": "urn:uma:default:RefreshTokenStore" }
+          "refreshStore": { "@id": "urn:uma:default:TokenStore" }
         }
       }
     }

packages/uma/config/routes/tokens.json

@@ -20,7 +20,7 @@
         "refreshTokenHandler": {
           "@id": "urn:uma:default:RefreshTokenHandler",
           "@type": "RefreshTokenHandler",
-          "refreshStore": { "@id": "urn:uma:default:RefreshTokenStore" },
+          "refreshStore": { "@id": "urn:uma:default:TokenStore" },
           "negotiator": { "@id": "urn:uma:default:Negotiator" }
         }
       },

packages/uma/config/tokens/storage/default.json

@@ -5,11 +5,10 @@
   "@graph": [
     {
       "@id": "urn:uma:default:TokenStore",
-      "@type": "MemoryMapStorage"
-    },
-    {
-      "@id": "urn:uma:default:RefreshTokenStore",
-      "@type": "MemoryMapStorage"
+      "@type": "WrappedExpiringStorage",
+      "source": {
+        "@type": "MemoryMapStorage"
+      }
     }
   ]
 }

packages/uma/src/tokens/JwtTokenFactory.ts

@@ -1,6 +1,7 @@
-import { BadRequestHttpError, createErrorMessage, JwkGenerator, KeyValueStorage } from '@solid/community-server';
+import { BadRequestHttpError, createErrorMessage, ExpiringStorage, JwkGenerator, } from '@solid/community-server';
 import { getLoggerFor } from 'global-logger-factory';
 import { importJWK, jwtVerify, SignJWT } from 'jose';
+import ms, { StringValue } from 'ms';
 import { randomUUID } from 'node:crypto';
 import { array, reType } from '../util/ReType';
 import { Permission } from '../views/Permission';
@@ -30,7 +31,7 @@ export class JwtTokenFactory extends TokenFactory {
   constructor(
     protected readonly keyGen: JwkGenerator,
     protected readonly issuer: string,
-    protected readonly tokenStore: KeyValueStorage<string, AccessToken>,
+    protected readonly tokenStore: ExpiringStorage<string, AccessToken>,
     protected readonly params: JwtTokenParams = { expirationTime: '30m', aud: 'solid' },
   ) {
     super();
@@ -54,9 +55,7 @@ export class JwtTokenFactory extends TokenFactory {
       .sign(jwk);
 
     this.logger.debug(`Issued new JWT Token ${JSON.stringify(token)}`);
-    // TODO: tokenstore should expire tokens eventually; can use expiring storage,
-    //       or just normal store with timer-based cleanup.
-    await this.tokenStore.set(jwt, token);
+    await this.tokenStore.set(jwt, token, ms(this.params.expirationTime as StringValue));
     return { token: jwt, tokenType: 'Bearer' };
   }
 

packages/uma/src/tokens/StoredRefreshTokenIssuer.ts

@@ -1,4 +1,4 @@
-import { KeyValueStorage } from '@solid/community-server';
+import { ExpiringStorage } from '@solid/community-server';
 import ms, { StringValue } from 'ms';
 import { randomUUID } from 'node:crypto';
 import { ClaimSet } from '../credentials/ClaimSet';
@@ -14,21 +14,19 @@ export class StoredRefreshTokenIssuer implements RefreshTokenIssuer {
   protected readonly refreshExpiration: number;
 
   public constructor(
-    protected readonly refreshStore: KeyValueStorage<string, RefreshInformation>,
+    protected readonly refreshStore: ExpiringStorage<string, RefreshInformation>,
     refreshExpiration: string = '7d',
   ) {
     this.refreshExpiration = ms(refreshExpiration as StringValue);
   }
 
   public async issue(claims: ClaimSet, permissions: Permission[]): Promise<string> {
     const refreshToken = randomUUID();
-    // TODO: expired tokens should be removed; can use expiring storage,
-    //       or just normal store with timer-based cleanup.
     await this.refreshStore.set(refreshToken, {
       claims,
       permissions,
       expiration: Date.now() + this.refreshExpiration,
-    });
+    }, this.refreshExpiration);
     return refreshToken;
   }
 }