chore: make cli session keys respect --session-duration

ethanndickson · ethanndickson · commit 2d3f8f4e1585 · 2024-09-10T07:58:28.000Z
diff --git a/coderd/apikey.go b/coderd/apikey.go
@@ -125,16 +125,11 @@ func (api *API) postAPIKey(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	user := httpmw.UserParam(r)
 
-	lifeTime := time.Hour * 24 * 7
 	cookie, _, err := api.createAPIKey(ctx, apikey.CreateParams{
 		UserID:          user.ID,
 		DefaultLifetime: api.DeploymentValues.Sessions.DefaultDuration.Value(),
 		LoginType:       database.LoginTypePassword,
 		RemoteAddr:      r.RemoteAddr,
-		// All api generated keys will last 1 week. Browser login tokens have
-		// a shorter life.
-		ExpiresAt:       dbtime.Now().Add(lifeTime),
-		LifetimeSeconds: int64(lifeTime.Seconds()),
 	})
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
diff --git a/coderd/apikey_test.go b/coderd/apikey_test.go
@@ -224,3 +224,41 @@ func TestAPIKey_Deleted(t *testing.T) {
 	require.ErrorAs(t, err, &apiErr)
 	require.Equal(t, http.StatusBadRequest, apiErr.StatusCode())
 }
+
+func TestAPIKey_Refresh(t *testing.T) {
+	t.Parallel()
+
+	db, pubsub := dbtestutil.NewDB(t)
+	client := coderdtest.New(t, &coderdtest.Options{
+		Database: db,
+		Pubsub:   pubsub,
+	})
+	owner := coderdtest.CreateFirstUser(t, client)
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+	defer cancel()
+
+	token, err := client.CreateAPIKey(ctx, owner.UserID.String())
+	require.NoError(t, err)
+	split := strings.Split(token.Key, "-")
+	apiKey1, err := client.APIKeyByID(ctx, owner.UserID.String(), split[0])
+	require.NoError(t, err)
+	require.Equal(t, int64(86400), apiKey1.LifetimeSeconds, "default should be 24 hours")
+
+	err = db.UpdateAPIKeyByID(ctx, database.UpdateAPIKeyByIDParams{
+		ID:       apiKey1.ID,
+		LastUsed: apiKey1.LastUsed,
+		// Cross the no-refresh threshold
+		ExpiresAt: apiKey1.ExpiresAt.Add(time.Hour * -2),
+	})
+	require.NoError(t, err, "update login key")
+
+	// Refresh the token
+	client.SetSessionToken(token.Key)
+	_, err = client.User(ctx, codersdk.Me)
+	require.NoError(t, err)
+
+	apiKey2, err := client.APIKeyByID(ctx, owner.UserID.String(), split[0])
+	require.NoError(t, err)
+	require.True(t, apiKey2.ExpiresAt.After(apiKey1.ExpiresAt), "token should have a later expiry")
+}
