mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-21 14:35:22 +08:00
Ghassan Gedeon Achi
c1a8522742
* fix(auth): expire Access Graph API sessions at session TTL, not bearer-token TTL
ACCESS_GRAPH_API web sessions authenticate via the client TLS
certificate in Handler.AuthenticateReqForAccessGraphAPI and never
consume a bearer token. Today they still get one generated and a
paired WebToken upserted. Two consumers
(lib/services/local.webSessions.Upsert computing the backend item
TTL, and lib/web.SessionContext.expired deciding aliveness) then
read the bearer-token expiry directly; for these sessions that's
misleading (the bearer is zero, and expired() silently treats a
zero expiry as "never expires"). This change lifts the usage-aware
choice into api/types.WebSession.GetEarliestExpiry, stops the
producers from generating the bearer artefacts, and updates both
consumers.
Behavioural changes:
- lib/auth.newWebSession no longer generates a BearerToken or
BearerTokenExpires for ACCESS_GRAPH_API sessions
- lib/auth.upsertWebSession skips UpsertWebToken for these sessions
(no paired WebToken would be meaningful, and creating one with an
empty token / zero expiry is misleading)
Centralisation:
- api/types: WebSession.GetEarliestExpiry() returns the time after
which a session should be considered dead, accounting for
Usage. Standard sessions return min(bearer, session) with zero
treated as infinity; ACCESS_GRAPH_API sessions return the
session expiry. Interface doc spells out the per-usage rule;
full rationale lives on WebSessionV2.GetEarliestExpiry.
- lib/services/local.webSessions.Upsert and lib/web
SessionContext.expired now call session.GetEarliestExpiry()
Tests:
- api/types: GetEarliestExpiry covers bearer<session,
bearer>session (capped), zero-bearer, zero-session, and
ACCESS_GRAPH_API
- lib/auth: CreateWebSessionFromReq for ACCESS_GRAPH_API leaves
bearer empty + zero expiry; types.NewWebToken's empty-token
validation means a successful call also proves UpsertWebToken
was skipped. UNSPECIFIED still populates bearer and upserts the
paired WebToken.
- lib/services/local: backend item Expires matches the per-usage
expiry choice through Upsert
* fix: remove backend.EarliestExpiry and update doc