backend-app-api: use minimum exp of plugin and obo token

Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
2024-04-08 14:21:35 +02:00
parent 91306c9fd1
commit 7978a58ded
1 changed files with 3 additions and 2 deletions
@@ -130,9 +130,10 @@ export class PluginTokenHandler {
    const sub = pluginId;
    const aud = targetPluginId;
    const iat = Math.floor(Date.now() / 1000);
+    const ourExp = iat + this.keyDurationSeconds;
    const exp = onBehalfOf
-      ? Math.floor(onBehalfOf.expiresAt.getTime() / 1000)
-      : iat + this.keyDurationSeconds;
+      ? Math.min(ourExp, Math.floor(onBehalfOf.expiresAt.getTime() / 1000))
+      : ourExp;

    const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token };
    const token = await new SignJWT(claims)