security/oauth/manager: introduce ticks to check expiration of tokens

it fixes issues when PC/VirtualPC was hibernated for time
so refreshing the token can occurs long time after token expired.

Author: jkralik

security/oauth/manager/config.go

@@ -18,6 +18,7 @@ type Config struct {
 	Endpoint       Endpoint      `envconfig:"ENDPOINT" env:"ENDPOINT"`
 	Audience       string        `envconfig:"AUDIENCE" env:"AUDIENCE"`
 	RequestTimeout time.Duration `envconfig:"REQUEST_TIMEOUT" env:"REQUEST_TIMEOUT" default:"10s"`
+	TickFrequency  time.Duration `envconfig:"TICK_FREQUENCY" env:"TICK_FREQUENCY" long:"tick-frequency" description:"how frequently we should check whether our token needs renewal" default:"15s"`
 }
 
 // ToClientCrendtials converts to clientcredentials.Config

security/oauth/manager/manager.go

@@ -10,36 +10,52 @@ import (
 	"golang.org/x/oauth2/clientcredentials"
 
 	"github.com/plgd-dev/kit/log"
-	"github.com/plgd-dev/kit/net/http/transport"
 	"golang.org/x/oauth2"
 )
 
 // Manager holds certificates from filesystem watched for changes
 type Manager struct {
-	mutex          sync.Mutex
-	config         clientcredentials.Config
-	tlsCfg         *tls.Config
-	requestTimeout time.Duration
-	token          *oauth2.Token
-	tokenErr       error
-	doneWg         sync.WaitGroup
-	done           chan struct{}
+	mutex             sync.Mutex
+	config            clientcredentials.Config
+	tlsCfg            *tls.Config
+	requestTimeout    time.Duration
+	tickFrequency     time.Duration
+	startRefreshToken time.Time
+	token             *oauth2.Token
+	httpClient        *http.Client
+	tokenErr          error
+	doneWg            sync.WaitGroup
+	done              chan struct{}
 }
 
 // NewManagerFromConfiguration creates a new oauth manager which refreshing token.
 func NewManagerFromConfiguration(config Config, tlsCfg *tls.Config) (*Manager, error) {
 	cfg := config.ToClientCrendtials()
-	token, err := getToken(cfg, tlsCfg, config.RequestTimeout)
+	t := http.DefaultTransport.(*http.Transport).Clone()
+	t.MaxIdleConns = 1
+	t.MaxConnsPerHost = 1
+	t.MaxIdleConnsPerHost = 1
+	t.IdleConnTimeout = time.Second * 30
+	t.TLSClientConfig = tlsCfg
+	httpClient := &http.Client{
+		Transport: t,
+		Timeout:   config.RequestTimeout,
+	}
+	token, startRefreshToken, err := getToken(cfg, httpClient, config.RequestTimeout)
 	if err != nil {
 		return nil, err
 	}
-	mgr := &Manager{
-		config: cfg,
-		token:  token,
-		tlsCfg: tlsCfg,
 
-		requestTimeout: config.RequestTimeout,
-		done:           make(chan struct{}),
+	mgr := &Manager{
+		config:            cfg,
+		token:             token,
+		tlsCfg:            tlsCfg,
+		startRefreshToken: startRefreshToken,
+		requestTimeout:    config.RequestTimeout,
+		httpClient:        httpClient,
+		tickFrequency:     config.TickFrequency,
+
+		done: make(chan struct{}),
 	}
 	mgr.doneWg.Add(1)
 
@@ -63,48 +79,50 @@ func (a *Manager) Close() {
 	}
 }
 
-func (a *Manager) nextRenewal() time.Duration {
-	t, _ := a.GetToken(context.Background())
-	now := time.Now()
-	lifetime := t.Expiry.Sub(now) * 2 / 3
-	if lifetime < a.requestTimeout {
-		lifetime = a.requestTimeout
-	}
-	return lifetime
+func (a *Manager) wantToRefresh() bool {
+	return time.Now().After(a.startRefreshToken)
 }
 
-func getToken(cfg clientcredentials.Config, tlsCfg *tls.Config, requestTimeout time.Duration) (*oauth2.Token, error) {
+func getToken(cfg clientcredentials.Config, httpClient *http.Client, requestTimeout time.Duration) (*oauth2.Token, time.Time, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), requestTimeout)
 	defer cancel()
 
-	t := transport.NewDefaultTransport()
-	t.TLSClientConfig = tlsCfg
-	httpClient := &http.Client{Transport: t}
 	ctx = context.WithValue(ctx, oauth2.HTTPClient, httpClient)
 
-	return cfg.Token(ctx)
+	token, err := cfg.Token(ctx)
+	var startRefreshToken time.Time
+	if err == nil {
+		now := time.Now()
+		startRefreshToken = now.Add(token.Expiry.Sub(now) * 2 / 3)
+	}
+	return token, startRefreshToken, err
 }
 
 func (a *Manager) refreshToken() {
-	token, err := getToken(a.config, a.tlsCfg, a.requestTimeout)
+	token, startRefreshToken, err := getToken(a.config, a.httpClient, a.requestTimeout)
 	if err != nil {
 		log.Errorf("cannot refresh token: %v", err)
 	}
 	a.mutex.Lock()
 	defer a.mutex.Unlock()
 	a.token = token
 	a.tokenErr = err
+	a.startRefreshToken = startRefreshToken
 }
 
 func (a *Manager) watchToken() {
 	defer a.doneWg.Done()
+	t := time.NewTicker(a.tickFrequency)
+	defer t.Stop()
+
 	for {
-		nextRenewal := a.nextRenewal()
 		select {
 		case <-a.done:
 			return
-		case <-time.After(nextRenewal):
-			a.refreshToken()
+		case <-t.C:
+			if a.wantToRefresh() {
+				a.refreshToken()
+			}
 		}
 	}
 }