feat(EphemeralSessions): Introduce lax period

Signed-off-by: Louis Chmn <[email protected]>

Author: artonge

lib/private/AppFramework/Middleware/FlowV2EphemeralSessionsMiddleware.php

@@ -11,32 +11,47 @@
 use OC\Core\Controller\ClientFlowLoginV2Controller;
 use OC\Core\Controller\TwoFactorChallengeController;
 use OCP\AppFramework\Middleware;
+use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\Authentication\TwoFactorAuth\ALoginSetupController;
 use OCP\ISession;
 use OCP\IUserSession;
 
 // Will close the session if the user session is ephemeral.
 // Happens when the user logs in via the login flow v2.
 class FlowV2EphemeralSessionsMiddleware extends Middleware {
+	private const EPHEMERAL_SESSION_TTL = 5 * 60; // 5 minutes
+
 	private ISession $session;
 	private IUserSession $userSession;
 	private ControllerMethodReflector $reflector;
+	private ITimeFactory $timeFactory;
 
 	public function __construct(
 		ISession $session,
 		IUserSession $userSession,
-		ControllerMethodReflector $reflector
+		ControllerMethodReflector $reflector,
+		ITimeFactory $timeFactory
 	) {
 		$this->session = $session;
 		$this->userSession = $userSession;
 		$this->reflector = $reflector;
+		$this->timeFactory = $timeFactory;
 	}
 
 	public function beforeController($controller, $methodName) {
-		if (!$this->session->get(ClientFlowLoginV2Controller::EPHEMERAL_NAME)) {
+		$sessionCreationTime = $this->session->get(ClientFlowLoginV2Controller::EPHEMERAL_NAME);
+
+		// Not an ephemeral session.
+		if ($sessionCreationTime === null) {
+			return;
+		}
+
+		// Lax enforcement until TTL is reached.
+		if ($this->timeFactory->getTime() < $sessionCreationTime + self::EPHEMERAL_SESSION_TTL) {
 			return;
 		}
 
+		// Allow certain controllers/methods to proceed without logging out.
 		if (
 			$controller instanceof ClientFlowLoginV2Controller &&
 			($methodName === 'grantPage' || $methodName === 'generateAppPassword')

lib/private/Authentication/Login/FlowV2EphemeralSessionsCommand.php

@@ -9,25 +9,29 @@
 namespace OC\Authentication\Login;
 
 use OC\Core\Controller\ClientFlowLoginV2Controller;
+use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\ISession;
 use OCP\IURLGenerator;
 
 class FlowV2EphemeralSessionsCommand extends ALoginCommand {
 	private ISession $session;
 	private IURLGenerator $urlGenerator;
+	private ITimeFactory $timeFactory;
 
 	public function __construct(
 		ISession $session,
-		IURLGenerator $urlGenerator
+		IURLGenerator $urlGenerator,
+		ITimeFactory $timeFactory
 	) {
 		$this->session = $session;
 		$this->urlGenerator = $urlGenerator;
+		$this->timeFactory = $timeFactory;
 	}
 
 	public function process(LoginData $loginData): LoginResult {
 		$loginV2GrantRoute = $this->urlGenerator->linkToRoute('core.ClientFlowLoginV2.grantPage');
 		if (str_starts_with($loginData->getRedirectUrl() ?? '', $loginV2GrantRoute)) {
-			$this->session->set(ClientFlowLoginV2Controller::EPHEMERAL_NAME, true);
+			$this->session->set(ClientFlowLoginV2Controller::EPHEMERAL_NAME, $this->timeFactory->getTime());
 		}
 
 		return $this->processNextOrFinishSuccessfully($loginData);