MIJN-9699-Bug - Bypasss IDP logout if token is expired

Dockerfile

@@ -30,6 +30,7 @@ WORKDIR /build-space
 COPY package-lock.json /build-space/
 COPY package.json /build-space/
 COPY vite.config.ts /build-space/
+COPY .env.local.template /build-space/
 COPY vendor /build-space/vendor
 COPY mocks/fixtures /build-space/mocks/fixtures
 
@@ -74,9 +75,6 @@ ENV MA_TEST_ACCOUNTS=$MA_TEST_ACCOUNTS
 ARG REACT_APP_BFF_API_URL=/api/v1
 ENV REACT_APP_BFF_API_URL=$REACT_APP_BFF_API_URL
 
-ARG REACT_APP_SENTRY_DSN=
-ENV REACT_APP_SENTRY_DSN=$REACT_APP_SENTRY_DSN
-
 ARG REACT_APP_ANALYTICS_ID=
 ENV REACT_APP_ANALYTICS_ID=$REACT_APP_ANALYTICS_ID
 

src/server/app.test.ts

@@ -25,27 +25,35 @@ describe('app', async () => {
     vi.resetModules();
   });
 
-  test('app middleware OT', async () => {
-    const appModule = await import('./app');
-    const app = appModule.forTesting.app;
-    expect(
-      app._router.stack.some((layer: ILayer) =>
-        'BFF_ID' in layer.handle ? layer.handle.BFF_ID === 'router-dev' : false
-      )
-    ).toBe(true);
-    expect(
-      app._router.stack.some((layer: ILayer) =>
-        'BFF_ID' in layer.handle ? layer.handle.BFF_ID === 'router-oidc' : false
-      )
-    ).toBe(false);
-    expect(
-      app._router.stack.some((layer: ILayer) =>
-        'BFF_ID' in layer.handle
-          ? layer.handle.BFF_ID === 'router-protected'
-          : false
-      )
-    ).toBe(true);
-  });
+  test(
+    'app middleware OT',
+    async () => {
+      const appModule = await import('./app');
+      const app = appModule.forTesting.app;
+      expect(
+        app._router.stack.some((layer: ILayer) =>
+          'BFF_ID' in layer.handle
+            ? layer.handle.BFF_ID === 'router-dev'
+            : false
+        )
+      ).toBe(true);
+      expect(
+        app._router.stack.some((layer: ILayer) =>
+          'BFF_ID' in layer.handle
+            ? layer.handle.BFF_ID === 'router-oidc'
+            : false
+        )
+      ).toBe(false);
+      expect(
+        app._router.stack.some((layer: ILayer) =>
+          'BFF_ID' in layer.handle
+            ? layer.handle.BFF_ID === 'router-protected'
+            : false
+        )
+      ).toBe(true);
+    },
+    { timeout: 10000 }
+  );
 
   test('app middleware AP', async () => {
     mocks.IS_AP = true;

src/server/auth/auth-config.ts

@@ -51,7 +51,6 @@ export const oidcConfigBase: ConfigParams = {
       getFromEnv('MA_APP_MODE') !== 'unittest'
         ? getSessionStore(openIdAuth as typeof expressSession, {
             tableName: OIDC_SESSIONS_TABLE_NAME,
-            ttlSeconds: OIDC_SESSION_MAX_AGE_SECONDS, // NOTE: Not sure if this works with rollingDuration
           })
         : undefined,
   },

src/server/auth/auth-helpers.ts

@@ -18,6 +18,7 @@ import {
 } from './auth-types';
 import { FeatureToggle } from '../../universal/config/feature-toggles';
 import { AppRoutes } from '../../universal/config/routes';
+import { ONE_SECOND_MS } from '../config/app';
 import { ExternalConsumerEndpoints } from '../routing/bff-routes';
 import { generateFullApiUrlBFF } from '../routing/route-helpers';
 import { captureException } from '../services/monitoring';
@@ -89,6 +90,7 @@ export function getAuth(req: Request) {
   return {
     token: oidcToken,
     profile,
+    expiresAt: maSession.expires_at,
   };
 }
 
@@ -126,31 +128,37 @@ export function decodeToken<T extends Record<string, string>>(
   return jose.decodeJwt(jwtToken) as unknown as T;
 }
 
+function isIDPSessionExpired(expiresAt: string) {
+  return new Date(parseInt(expiresAt, 10) * ONE_SECOND_MS) < new Date();
+}
+
 export function createLogoutHandler(
   postLogoutRedirectUrl: string,
   doIDPLogout: boolean = true
 ) {
   return async (req: AuthenticatedRequest, res: Response) => {
-    if (req.oidc.isAuthenticated() && doIDPLogout) {
-      const auth = getAuth(req);
-      if (auth) {
-        // Add the session ID to a blacklist. This way the jwt id_token, which itself has longer lifetime, cannot be reused after logging out at IDP.
-        if (auth.profile.sid) {
-          await addToBlackList(auth.profile.sid);
-        }
-
-        return res.oidc.logout({
-          returnTo: postLogoutRedirectUrl,
-          logoutParams: {
-            id_token_hint: !FeatureToggle.oidcLogoutHintActive
-              ? auth.token
-              : null,
-            logout_hint: FeatureToggle.oidcLogoutHintActive
-              ? req[OIDC_SESSION_COOKIE_NAME]?.TMASessionID
-              : null,
-          },
-        });
+    const auth = getAuth(req);
+    if (
+      auth &&
+      req.oidc.isAuthenticated() &&
+      (doIDPLogout ? isIDPSessionExpired(auth.expiresAt) : false)
+    ) {
+      // Add the session ID to a blacklist. This way the jwt id_token, which itself has longer lifetime, cannot be reused after logging out at IDP.
+      if (auth.profile.sid) {
+        await addToBlackList(auth.profile.sid);
       }
+
+      return res.oidc.logout({
+        returnTo: postLogoutRedirectUrl,
+        logoutParams: {
+          id_token_hint: !FeatureToggle.oidcLogoutHintActive
+            ? auth.token
+            : null,
+          logout_hint: FeatureToggle.oidcLogoutHintActive
+            ? req[OIDC_SESSION_COOKIE_NAME]?.TMASessionID
+            : null,
+        },
+      });
     }
 
     if (hasSessionCookie(req)) {

src/server/auth/auth-session-store.ts

@@ -10,7 +10,6 @@ import { pool } from '../services/db/postgres';
 
 type SessionStoreOptions = {
   tableName: string;
-  ttlSeconds?: number;
 };
 
 export function getSessionStore<T extends typeof expressSession>(
@@ -25,7 +24,6 @@ export function getSessionStore<T extends typeof expressSession>(
       tableName: options.tableName,
       pool,
       createTableIfMissing: true,
-      ttl: options.ttlSeconds,
     }) as unknown as SessionStore<Session>;
   }
 

src/server/auth/auth-types.ts

@@ -15,6 +15,7 @@ export interface MaSession extends Session {
   TMASessionID: string; // TMA Session ID
   profileType: ProfileType;
   authMethod: AuthMethod;
+  expires_at: string;
 }
 
 export interface AuthProfileAndToken {

src/server/routing/route-handlers.ts

@@ -58,11 +58,13 @@ export function verifyAuthenticated(
 ) {
   return async (req: Request, res: Response) => {
     if (await isRequestAuthenticated(req, authMethod)) {
+      const auth = getAuth(req);
       return res.send(
         apiSuccessResult({
           isAuthenticated: true,
           profileType,
           authMethod,
+          expiresAt: auth?.expiresAt,
         })
       );
     }