feat: add early expiry to tokens

Refreshing the token slightly ahead of its expiry
can help prevent phony unauthorized access errors.

Author: bevzzz

src/main/java/io/weaviate/client6/v1/internal/ReuseTokenProvider.java

@@ -20,9 +20,25 @@
 @ThreadSafe
 final class ReuseTokenProvider implements TokenProvider {
   private final TokenProvider provider;
+  private final long expiryDelta;
 
   private volatile Token token;
 
+  /**
+   * Create new {@link ReuseTokenProvider} from another {@link TokenProvider}.
+   * Wrapping an instance ReuseTokenProvider returns that instance if the token is
+   * {@code null}, so this method is safe to call with any TokenProvider.
+   */
+  static TokenProvider wrap(Token t, TokenProvider tp, long expiryDelta) {
+    if (tp instanceof ReuseTokenProvider rtp) {
+      if (t == null) {
+        // Use it directly, but set new expirty delta.
+        return rtp.withExpiryDelta(expiryDelta);
+      }
+    }
+    return new ReuseTokenProvider(t, tp, expiryDelta);
+  }
+
   /**
    * Create new {@link ReuseTokenProvider} from another {@link TokenProvider}.
    * Wrapping an instance ReuseTokenProvider returns that instance if the token is
@@ -34,12 +50,24 @@ static TokenProvider wrap(Token t, TokenProvider tp) {
         return rtp; // Use it directly.
       }
     }
-    return new ReuseTokenProvider(t, tp);
+    return new ReuseTokenProvider(t, tp, 0);
+  }
+
+  /**
+   * Create a new TokenProvider with a different expiryDelta.
+   * Tokens obtained from this TokenProvider with have the same early expiry.
+   *
+   * @param expiryDelta Early expiry in seconds.
+   * @return A new TokenProvider.
+   */
+  TokenProvider withExpiryDelta(long expirtyDelta) {
+    return new ReuseTokenProvider(this.token, this.provider, expirtyDelta);
   }
 
-  private ReuseTokenProvider(Token t, TokenProvider tp) {
+  private ReuseTokenProvider(Token t, TokenProvider tp, long expiryDelta) {
     this.provider = tp;
     this.token = t;
+    this.expiryDelta = expiryDelta;
   }
 
   @Override
@@ -49,7 +77,7 @@ public Token getToken() {
     }
     synchronized (this) {
       if (token == null || !token.isValid()) {
-        token = provider.getToken();
+        token = provider.getToken().withExpiryDelta(expiryDelta);
       }
     }
     return token;

src/main/java/io/weaviate/client6/v1/internal/TokenProvider.java

@@ -13,7 +13,7 @@ public interface TokenProvider {
   Token getToken();
 
   /** Token represents an access_token + refresh_token pair. */
-  public record Token(String accessToken, String refreshToken, Instant createdAt, long expiresIn) {
+  public record Token(String accessToken, String refreshToken, Instant createdAt, long expiresIn, long expiryDelta) {
     /**
      * Returns {@code true} if remaining lifetime of the token is greater than 0.
      * Tokens created with {@link #expireNever} are always valid.
@@ -22,8 +22,21 @@ public boolean isValid() {
       if (expiresIn == -1) {
         return true;
       }
-      // TODO: adjust for expireDelta
-      return Instant.now().isAfter(createdAt.plusSeconds(expiresIn));
+      return Instant.now().isBefore(createdAt.plusSeconds(expiresIn - expiryDelta));
+    }
+
+    /**
+     * Set early expiry for the Token.
+     *
+     * <p>
+     * A Token with {@link #expiresIn} of 10s and {@link #expiryDelta} of 3s
+     * will be invalid 7s after being created.
+     *
+     * @param expiryDelta Early expiry in seconds.
+     * @return A Token identical to the source one, but with a different expiry.
+     */
+    public Token withExpiryDelta(long expiryDelta) {
+      return new Token(accessToken, refreshToken, createdAt, expiresIn, expiryDelta);
     }
 
     /**
@@ -36,11 +49,13 @@ public boolean isValid() {
      * @return A new Token.
      */
     public static Token expireAfter(String accessToken, String refreshToken, long expiresIn) {
-      return new Token(accessToken, refreshToken, Instant.now(), expiresIn);
+      return new Token(accessToken, refreshToken, Instant.now(), expiresIn, 0);
     }
 
     /**
      * Create a token that does not have a refresh_token.
+     * For example, a token obtained via a Client Credentials grant
+     * can only be renewed using that grant type.
      *
      * @param accessToken Access token.
      * @param expiresIn   Remaining token lifetime in seconds.
@@ -62,6 +77,20 @@ public static Token expireNever(String accessToken) {
     }
   }
 
+  /**
+   * Refreshing the token slightly ahead of time will help prevent
+   * phony unauthorized access errors.
+   *
+   * This value is currently not configuratble and should be seen
+   * as an internal implementation detail.
+   */
+  static long DEFAULT_EARLY_EXPIRY = 30;
+
+  /**
+   * Authorize using a token that never expires and doesn't need to be refreshed.
+   *
+   * @param apiKey Access token.
+   */
   public static TokenProvider staticToken(String accessToken) {
     final var token = Token.expireNever(accessToken);
     return () -> token;
@@ -83,7 +112,7 @@ public static TokenProvider staticToken(String accessToken) {
   public static TokenProvider bearerToken(OidcConfig oidc, String accessToken, String refreshToken, long expiresIn) {
     final var token = Token.expireAfter(accessToken, refreshToken, expiresIn);
     final var provider = NimbusTokenProvider.refreshToken(oidc, token);
-    return reuse(token, provider);
+    return reuse(token, provider, DEFAULT_EARLY_EXPIRY);
   }
 
   /**
@@ -99,7 +128,7 @@ public static TokenProvider bearerToken(OidcConfig oidc, String accessToken, Str
    */
   public static TokenProvider resourceOwnerPassword(OidcConfig oidc, String username, String password) {
     final var passwordGrant = NimbusTokenProvider.resourceOwnerPassword(oidc, username, password);
-    return reuse(null, exchange(oidc, passwordGrant));
+    return reuse(null, exchange(oidc, passwordGrant), DEFAULT_EARLY_EXPIRY);
   }
 
   /**
@@ -115,7 +144,7 @@ public static TokenProvider resourceOwnerPassword(OidcConfig oidc, String userna
    */
   public static TokenProvider clientCredentials(OidcConfig oidc, String clientId, String clientSecret) {
     final var provider = NimbusTokenProvider.clientCredentials(oidc, clientId, clientSecret);
-    return reuse(null, provider);
+    return reuse(null, provider, DEFAULT_EARLY_EXPIRY);
   }
 
   /**
@@ -133,6 +162,14 @@ static TokenProvider reuse(Token t, TokenProvider tp) {
     return ReuseTokenProvider.wrap(t, tp);
   }
 
+  /**
+   * Obtain a TokenProvider which reuses tokens obtained
+   * from another TokenProvider until they expire.
+   */
+  static TokenProvider reuse(Token t, TokenProvider tp, long expiryDelta) {
+    return ReuseTokenProvider.wrap(t, tp, expiryDelta);
+  }
+
   public record ProviderMetadata(URI tokenEndpoint) {
   }
 

src/test/java/io/weaviate/client6/v1/internal/TokenTest.java

@@ -0,0 +1,36 @@
+package io.weaviate.client6.v1.internal;
+
+import java.time.Instant;
+
+import org.assertj.core.api.Assertions;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import com.jparams.junit4.JParamsTestRunner;
+import com.jparams.junit4.data.DataMethod;
+
+import io.weaviate.client6.v1.internal.TokenProvider.Token;
+
+@RunWith(JParamsTestRunner.class)
+public class TokenTest {
+
+  public static Object[][] testCaseTokens() {
+    return new Object[][] {
+        { Token.expireNever("access_token"), true },
+        { Token.expireAfter("access_token", "refresh_token", 100), true },
+        { Token.expireAfter("access_token", 100), true },
+        { new Token("access_token", "refresh_token", Instant.now().minusSeconds(10), 5, 0), false },
+        { Token.expireAfter("access_token", 0), false },
+        { Token.expireAfter("access_token", 5).withExpiryDelta(10), false },
+        { Token.expireAfter("access_token", 100).withExpiryDelta(10), true },
+    };
+  }
+
+  @DataMethod(source = TokenTest.class, method = "testCaseTokens")
+  @Test
+  public void test_isValid(Token token, boolean wantValid) {
+    Assertions.assertThat(token.isValid())
+        .as(token.toString())
+        .isEqualTo(wantValid);
+  }
+}