feat(auth): add session ttl reuse

Author: casey-brooks

.env.development

@@ -12,3 +12,4 @@ LOGTO_CLIENT_SECRET=o4lvhz8xT5W6nKgAFOBNTqjArJYPcWYx
 
 MOCKAUTH_KEY_ENCRYPTION_SECRET=abcdefghijklmnopqrstuvwxyz123456
 MOCKAUTH_ALLOW_ANY_REDIRECT=false
+MOCKAUTH_SESSION_TTL_SECONDS=2592000

.env.example

@@ -12,6 +12,7 @@ LOGTO_CLIENT_SECRET=replace-with-logto-client-secret
 MOCKAUTH_KEY_ENCRYPTION_SECRET=replace-with-32-character-secret
 MOCKAUTH_ALLOW_ANY_REDIRECT=false
 MOCKAUTH_ALLOW_INSECURE_TEST_COOKIE=false
+MOCKAUTH_SESSION_TTL_SECONDS=2592000
 
 AUDIT_LOG_RETENTION_DAYS=90
 CRON_SECRET=replace-with-cron-secret

.env.test

@@ -13,4 +13,5 @@ MOCKAUTH_KEY_ENCRYPTION_SECRET=abcdefghijklmnopqrstuvwxyz123456
 MOCKAUTH_ALLOW_ANY_REDIRECT=false
 ENABLE_TEST_ROUTES=true
 MOCKAUTH_ALLOW_INSECURE_TEST_COOKIE=true
+MOCKAUTH_SESSION_TTL_SECONDS=2592000
 PLAYWRIGHT_LD_LIBRARY_PATH=../playwright-libs/sysroot/usr/lib/x86_64-linux-gnu:../playwright-libs/sysroot/usr/lib/x86_64-linux-gnu/gbm

src/app/admin/clients/[clientId]/test/navigation.ts

@@ -0,0 +1,3 @@
+export const navigateTo = (url: string) => {
+  window.location.assign(url);
+};

src/app/admin/clients/[clientId]/test/test-run-again-button.tsx

@@ -1,12 +1,12 @@
 "use client";
 
 import { useTransition } from "react";
-import { useRouter } from "next/navigation";
 import type { ReactNode } from "react";
 
 import { prepareClientOauthTestAction } from "@/app/admin/actions";
 import { Button, type ButtonProps } from "@/components/ui/button";
 import { useToast } from "@/components/ui/use-toast";
+import { navigateTo } from "@/app/admin/clients/[clientId]/test/navigation";
 
 type Props = {
   clientId: string;
@@ -20,7 +20,6 @@ type Props = {
 
 export function TestRunAgainButton({ clientId, scopes, redirectUri, variant, size, testId, children }: Props) {
   const [pending, startTransition] = useTransition();
-  const router = useRouter();
   const { toast } = useToast();
   const label = children ?? "Run again";
 
@@ -36,7 +35,7 @@ export function TestRunAgainButton({ clientId, scopes, redirectUri, variant, siz
           });
           return;
         }
-        router.push(result.data.authorizationUrl);
+        navigateTo(result.data.authorizationUrl);
       } catch (error) {
         const description = error instanceof Error ? error.message : "Unknown error";
         toast({ variant: "destructive", title: "Unable to restart test", description });

src/app/admin/clients/__tests__/test-run-again-button.test.tsx

@@ -7,7 +7,7 @@ import { TestRunAgainButton } from "../[clientId]/test/test-run-again-button";
 
 const mockPrepare = vi.hoisted(() => vi.fn().mockResolvedValue({ data: { authorizationUrl: "https://auth.example.test" } }));
 const mockToast = vi.hoisted(() => vi.fn());
-const mockPush = vi.hoisted(() => vi.fn());
+const mockNavigate = vi.hoisted(() => vi.fn());
 
 vi.mock("@/app/admin/actions", () => ({
   prepareClientOauthTestAction: mockPrepare,
@@ -17,15 +17,15 @@ vi.mock("@/components/ui/use-toast", () => ({
   useToast: () => ({ toast: mockToast }),
 }));
 
-vi.mock("next/navigation", () => ({
-  useRouter: () => ({ push: mockPush }),
+vi.mock("@/app/admin/clients/[clientId]/test/navigation", () => ({
+  navigateTo: mockNavigate,
 }));
 
 describe("TestRunAgainButton", () => {
   beforeEach(() => {
     mockPrepare.mockClear();
     mockToast.mockClear();
-    mockPush.mockClear();
+    mockNavigate.mockClear();
   });
 
   it("restarts the OAuth test using prior settings", async () => {
@@ -41,7 +41,7 @@ describe("TestRunAgainButton", () => {
         redirectUri: "https://admin.example.test/callback",
         promptLogin: false,
       });
-      expect(mockPush).toHaveBeenCalledWith("https://auth.example.test");
+      expect(mockNavigate).toHaveBeenCalledWith("https://auth.example.test");
     });
   });
 
@@ -58,7 +58,7 @@ describe("TestRunAgainButton", () => {
         title: "Unable to restart test",
         description: "Client missing",
       });
-      expect(mockPush).not.toHaveBeenCalled();
+      expect(mockNavigate).not.toHaveBeenCalled();
     });
   });
 
@@ -75,7 +75,7 @@ describe("TestRunAgainButton", () => {
         title: "Unable to restart test",
         description: "Network down",
       });
-      expect(mockPush).not.toHaveBeenCalled();
+      expect(mockNavigate).not.toHaveBeenCalled();
     });
   });
 
@@ -91,7 +91,7 @@ describe("TestRunAgainButton", () => {
 
     await waitFor(() => {
       expect(mockPrepare).toHaveBeenCalled();
-      expect(mockPush).toHaveBeenCalledWith("https://auth.example.test");
+      expect(mockNavigate).toHaveBeenCalledWith("https://auth.example.test");
     });
   });
 });

src/app/r/[apiResourceId]/oidc/login/submit/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import { z } from "zod";
 
+import { env } from "@/server/env";
 import { toResponse } from "@/server/errors";
 import { findOrCreateMockUser } from "@/server/services/mock-user-service";
 import { createSession, MOCK_SESSION_COOKIE } from "@/server/services/mock-session-service";
@@ -125,7 +126,7 @@ export async function POST(request: NextRequest, context: ApiResourceRouteContex
       httpOnly: true,
       sameSite: "lax",
       secure: isSecure,
-      maxAge: 60 * 60 * 12,
+      maxAge: env.MOCKAUTH_SESSION_TTL_SECONDS,
     });
     const reauthCookieValue = createReauthCookieValue({
       tenantId: tenant.id,

src/server/auth/__tests__/options.test.ts

@@ -17,6 +17,7 @@ const baseEnv: AppEnv = {
   ENABLE_TEST_ROUTES: true,
   ALLOW_EMAIL_LINKING: false,
   MOCKAUTH_ALLOW_INSECURE_TEST_COOKIE: false,
+  MOCKAUTH_SESSION_TTL_SECONDS: 2592000,
   AUDIT_LOG_RETENTION_DAYS: 90,
 };
 

src/server/env.ts

@@ -35,6 +35,10 @@ const envSchema = z.object({
     .optional()
     .default("false")
     .transform((value) => value === "true"),
+  MOCKAUTH_SESSION_TTL_SECONDS: z.preprocess(
+    (value) => (value === undefined ? undefined : Number(value)),
+    z.number().int().min(1).default(2592000),
+  ),
   AUDIT_LOG_RETENTION_DAYS: z.preprocess(
     (value) => (value === undefined ? undefined : Number(value)),
     z.number().int().min(1).default(90),
@@ -56,6 +60,7 @@ const buildRawEnv = () => {
     ENABLE_TEST_ROUTES: process.env.ENABLE_TEST_ROUTES,
     ALLOW_EMAIL_LINKING: process.env.ALLOW_EMAIL_LINKING,
     MOCKAUTH_ALLOW_INSECURE_TEST_COOKIE: process.env.MOCKAUTH_ALLOW_INSECURE_TEST_COOKIE,
+    MOCKAUTH_SESSION_TTL_SECONDS: process.env.MOCKAUTH_SESSION_TTL_SECONDS,
     AUDIT_LOG_RETENTION_DAYS: process.env.AUDIT_LOG_RETENTION_DAYS,
     CRON_SECRET: process.env.CRON_SECRET,
   } satisfies Record<string, string | undefined>;

src/server/oidc/__tests__/oidc-flow.test.ts

@@ -271,7 +271,7 @@ describe("OIDC flow", () => {
     expect(violation?.details).toMatchObject({ reason: "pkce_mismatch" });
   });
 
-  it("requires an explicit login step before issuing codes", async () => {
+  it("reuses the session when prompt is absent", async () => {
     const challenge = computeS256Challenge(codeVerifier);
     const returnTo = `https://mockauth.test/r/${apiResourceId}/oidc/authorize?client_id=${CLIENT_ID}`;
     const authorize = await handleAuthorize(
@@ -290,9 +290,9 @@ describe("OIDC flow", () => {
       returnTo,
     );
 
-    expect(authorize.type).toBe("login");
-    expect(authorize.redirectTo).toContain("return_to=");
-    expect(decodeURIComponent(authorize.redirectTo.split("return_to=")[1]!)).toBe(returnTo);
+    expect(authorize.type).toBe("redirect");
+    const redirectUrl = new URL(authorize.redirectTo);
+    expect(redirectUrl.searchParams.get("code")).toBeTruthy();
   });
 
   it("rejects invalid redirect_uri values", async () => {
@@ -571,7 +571,7 @@ describe("OIDC flow", () => {
     expect(authorize.type).toBe("login");
   });
 
-  it("requires login when the cookie is expired", async () => {
+  it("reuses the session when the reauth cookie is expired", async () => {
     vi.useFakeTimers();
     try {
       vi.setSystemTime(new Date("2024-01-01T00:00:00.000Z"));
@@ -594,7 +594,9 @@ describe("OIDC flow", () => {
         `https://mockauth.test/r/${apiResourceId}/oidc/authorize?client_id=${CLIENT_ID}`,
       );
 
-      expect(authorize.type).toBe("login");
+      expect(authorize.type).toBe("redirect");
+      const redirectUrl = new URL(authorize.redirectTo);
+      expect(redirectUrl.searchParams.get("code")).toBeTruthy();
     } finally {
       vi.useRealTimers();
     }