Accept float also for token expiry

Author: MarcialRosales

deps/oauth2_client/src/jwt_helper.erl

@@ -18,5 +18,6 @@ decode(Token) ->
         {error, {invalid_token, Type, Err, Stacktrace}}
     end.
 
-get_expiration_time(#{<<"exp">> := Exp}) when is_integer(Exp) -> {ok, Exp};
+get_expiration_time(#{<<"exp">> := Exp}) when is_number(Exp) -> {ok, trunc(Exp)};
+get_expiration_time(#{<<"exp">> := _}) -> {error, invalid_exp_field};
 get_expiration_time(#{}) -> {error, missing_exp_field}.

deps/rabbitmq_auth_backend_oauth2/src/rabbit_auth_backend_oauth2.erl

@@ -160,7 +160,6 @@ update_state(AuthUser, NewToken) ->
 -spec expiry_timestamp(rabbit_types:auth_user()) -> integer() | never.
 expiry_timestamp(#auth_user{impl = DecodedTokenFun}) ->
     case DecodedTokenFun() of
-        %% "exp" may be a fractional NumericDate (RFC 7519); accept floats too.
         #{<<"exp">> := Exp} when is_number(Exp) ->
             trunc(Exp);
         _ ->
@@ -236,14 +235,15 @@ ensure_same_username(PreferredUsernameClaims, CurrentDecodedToken, NewDecodedTok
         _ -> {error, mismatch_username_after_token_refresh}
     end.
 
-%% "exp" may be a fractional NumericDate (RFC 7519); accept floats too.
 validate_token_expiry(#{<<"exp">> := Exp}) when is_number(Exp) ->
-    ExpSeconds = trunc(Exp),
     Now = os:system_time(seconds),
-    case ExpSeconds =< Now of
-        true  -> {error, rabbit_misc:format("Provided JWT token has expired at timestamp ~tp (validated at ~tp)", [ExpSeconds, Now])};
+    ExpTs = trunc(Exp),
+    case ExpTs =< Now of
+        true  -> {error, rabbit_misc:format("Provided JWT token has expired at timestamp ~tp (validated at ~tp)", [ExpTs, Now])};
         false -> ok
     end;
+validate_token_expiry(#{<<"exp">> := _}) ->
+    {error, "Provided JWT token has an invalid exp claim: value is not a number"};
 validate_token_expiry(#{}) -> ok.
 
 -spec check_token(raw_jwt_token(), {resource_server(), internal_oauth_provider()}) ->

deps/rabbitmq_auth_backend_oauth2/test/unit_SUITE.erl

@@ -40,7 +40,8 @@ all() ->
         test_restricted_vhost_access_with_a_valid_token,
         test_insufficient_permissions_in_a_valid_token,
         test_token_expiration,
-        test_token_expiration_with_float_exp,
+        test_token_expiry_with_float_exp,
+        test_token_expiry_with_non_numeric_exp,
         test_invalid_signature,
         test_incorrect_kid,
         normalize_token_scope_using_multiple_scopes_key,
@@ -1242,6 +1243,40 @@ test_token_expiration(_) ->
     ?assertMatch({refused, _, _},
                  user_login_authentication(Username, [{password, Token}])).
 
+test_token_expiry_with_float_exp(_) ->
+    Username = <<"username">>,
+    set_env(resource_server_id, <<"rabbitmq">>),
+
+    %% A valid, future float exp must be accepted and expiry_timestamp must
+    %% return the truncated integer — not the atom 'never'.
+    FutureFloatExp = float(os:system_time(seconds) + 600),
+    FutureToken = (?UTIL_MOD:token_with_sub(?UTIL_MOD:expirable_token(), Username))
+                    #{<<"exp">> := FutureFloatExp},
+    {ok, #auth_user{username = Username} = User} =
+        user_login_authentication(Username, [{password, FutureToken}]),
+    ?assertEqual(trunc(FutureFloatExp), rabbit_auth_backend_oauth2:expiry_timestamp(User)),
+
+    %% An already-expired float exp must be refused, not silently accepted.
+    PastFloatExp = float(os:system_time(seconds) - 10),
+    ExpiredToken = (?UTIL_MOD:token_with_sub(?UTIL_MOD:expirable_token(), Username))
+                    #{<<"exp">> := PastFloatExp},
+    ?assertMatch({refused, _, _},
+                 user_login_authentication(Username, [{password, ExpiredToken}])).
+
+test_token_expiry_with_non_numeric_exp(_) ->
+    Username = <<"username">>,
+    set_env(resource_server_id, <<"rabbitmq">>),
+
+    %% A token whose exp claim is not a number (e.g. a string) must be refused,
+    %% not silently accepted because the is_number guard falls through to the
+    %% no-exp-field catch-all clause.
+    lists:foreach(fun(NonNumericExp) ->
+        InvalidToken = (?UTIL_MOD:token_with_sub(?UTIL_MOD:expirable_token(), Username))
+                        #{<<"exp">> := NonNumericExp},
+        ?assertMatch({refused, _, _},
+                     user_login_authentication(Username, [{password, InvalidToken}]))
+    end, [<<"1700000300">>, true, false, null]).
+
 test_incorrect_kid(_) ->
     AltKid   = <<"other-token-key">>,
     Username = <<"username">>,