From 7978a58ded5fd0bc7e819abb3a408dadc7cbb866 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 8 Apr 2024 14:21:35 +0200 Subject: [PATCH] backend-app-api: use minimum exp of plugin and obo token Signed-off-by: Patrik Oldsberg --- .../src/services/implementations/auth/PluginTokenHandler.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts b/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts index 14315bbf78..7e9ac4220b 100644 --- a/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts +++ b/packages/backend-app-api/src/services/implementations/auth/PluginTokenHandler.ts @@ -130,9 +130,10 @@ export class PluginTokenHandler { const sub = pluginId; const aud = targetPluginId; const iat = Math.floor(Date.now() / 1000); + const ourExp = iat + this.keyDurationSeconds; const exp = onBehalfOf - ? Math.floor(onBehalfOf.expiresAt.getTime() / 1000) - : iat + this.keyDurationSeconds; + ? Math.min(ourExp, Math.floor(onBehalfOf.expiresAt.getTime() / 1000)) + : ourExp; const claims = { sub, aud, iat, exp, obo: onBehalfOf?.token }; const token = await new SignJWT(claims)