From 88979c847e3a613ff32c8ee0087b10573b3c4c78 Mon Sep 17 00:00:00 2001
From: sebadob <sebastiandobe@mailbox.org>
Date: Tue, 26 Sep 2023 10:58:06 +0200
Subject: [PATCH 1/6] impl user expiry admin ui

---
 .../components/admin/users/UserInfo.svelte    | 42 ++++++++++++-
 frontend/src/utils/helpers.js                 | 59 +++++++++++--------
 2 files changed, 77 insertions(+), 24 deletions(-)

diff --git a/frontend/src/components/admin/users/UserInfo.svelte b/frontend/src/components/admin/users/UserInfo.svelte
index 18f041a1..af00c1c6 100644
--- a/frontend/src/components/admin/users/UserInfo.svelte
+++ b/frontend/src/components/admin/users/UserInfo.svelte
@@ -1,6 +1,11 @@
 <script>
     import * as yup from "yup";
-    import {extractFormErrors, formatDateFromTs} from "../../../utils/helpers.js";
+    import {
+        extractFormErrors,
+        formatDateFromTs,
+        formatDateToDateInput,
+        formatUtcTsFromDateInput
+    } from "../../../utils/helpers.js";
     import Switch from "$lib/Switch.svelte";
     import {globalGroupsNames, globalRolesNames} from "../../../stores/admin.js";
     import Button from "$lib/Button.svelte";
@@ -20,6 +25,8 @@
     let success = false;
     let timer;
     let language = user.language.toUpperCase();
+    let limitLifetime = !!user.user_expires;
+    let userExpires = limitLifetime ? formatDateToDateInput(new Date(user.user_expires * 1000)) : undefined;
 
     let allRoles = [];
     globalRolesNames.subscribe(rls => {
@@ -72,8 +79,18 @@
             groups: user.groups,
             enabled: user.enabled,
             email_verified: user.email_verified,
+            user_expires: null,
         };
 
+        if (limitLifetime) {
+            let d = formatUtcTsFromDateInput(userExpires);
+            if (!d) {
+                err = 'Invalid Date Input: User Expires';
+                return;
+            }
+            req.user_expires = d;
+        }
+
         let res = await putUser(user.id, req);
         if (res.ok) {
             success = true;
@@ -197,6 +214,29 @@
         />
     </div>
 
+    <!-- Limit Lifetime -->
+    <div class="unit" style:margin-top="12px">
+        <div class="label font-label">
+            LIMIT LIFETIME
+        </div>
+        <div class="value">
+            <Switch bind:selected={limitLifetime}/>
+        </div>
+    </div>
+    {#if limitLifetime}
+        <Input
+                type="datetime-local"
+                step="60"
+                width="18rem"
+                bind:value={userExpires}
+                on:input={validateForm}
+                min={new Date().toISOString().split('.')[0]}
+                max="2099-01-01T00:00"
+        >
+            USER EXPIRES
+        </Input>
+    {/if}
+
     <!-- Last Login-->
     <div class="unit" style:margin-top="12px">
         <div class="label font-label">
diff --git a/frontend/src/utils/helpers.js b/frontend/src/utils/helpers.js
index 8e9a85e4..4810bde8 100644
--- a/frontend/src/utils/helpers.js
+++ b/frontend/src/utils/helpers.js
@@ -13,25 +13,25 @@ import {
 import sjcl from "sjcl";
 import { decode, encode } from "base64-arraybuffer";
 
-export function getCookie(cname) {
-	let name = cname + "=";
-	let decodedCookie = decodeURIComponent(document.cookie);
-	let ca = decodedCookie.split(';');
-	for (let i = 0; i < ca.length; i++) {
-		let c = ca[i];
-		while (c.charAt(0) === ' ') {
-			c = c.substring(1);
-		}
-		if (c.indexOf(name) === 0) {
-			return c.substring(name.length, c.length);
-		}
-	}
-	return "";
-}
-
-function deleteCookie(name) {
-	document.cookie = name + '=; Max-Age=-1;';
-}
+// export function getCookie(cname) {
+// 	let name = cname + "=";
+// 	let decodedCookie = decodeURIComponent(document.cookie);
+// 	let ca = decodedCookie.split(';');
+// 	for (let i = 0; i < ca.length; i++) {
+// 		let c = ca[i];
+// 		while (c.charAt(0) === ' ') {
+// 			c = c.substring(1);
+// 		}
+// 		if (c.indexOf(name) === 0) {
+// 			return c.substring(name.length, c.length);
+// 		}
+// 	}
+// 	return "";
+// }
+//
+// function deleteCookie(name) {
+// 	document.cookie = name + '=; Max-Age=-1;';
+// }
 
 export function extractFormErrors(err) {
 	return err.inner.reduce((acc, err) => {
@@ -134,12 +134,25 @@ export const computePow = (powChallenge) => {
 }
 
 
-export const dateFromUtcTs = (ts) => {
-	const utcOffsetMinutes = -new Date().getTimezoneOffset();
-	return new Date((ts + utcOffsetMinutes * 60) * 1000);
+// export const dateFromUtcTs = (ts) => {
+// 	const utcOffsetMinutes = -new Date().getTimezoneOffset();
+// 	return new Date((ts + utcOffsetMinutes * 60) * 1000);
+// }
+
+export const formatDateToDateInput = date => {
+	return date.toISOString().split('.')[0];
+}
+
+export const formatUtcTsFromDateInput = inputDate => {
+	let d = Date.parse(inputDate);
+	if (isNaN(d)) {
+		return;
+	}
+	const tzDiff = -new Date().getTimezoneOffset() * 60;
+	return d / 1000 + tzDiff;
 }
 
-export const formatDateFromTs = (ts) => {
+export const formatDateFromTs = ts => {
 	const utcOffsetMinutes = -new Date().getTimezoneOffset();
 	const d = new Date((ts + utcOffsetMinutes * 60) * 1000);
 

From c2853b3f146cc0ec6eb9862deefc9e2cfb032901 Mon Sep 17 00:00:00 2001
From: sebadob <sebastiandobe@mailbox.org>
Date: Tue, 26 Sep 2023 10:58:34 +0200
Subject: [PATCH 2/6] impl user expiry api request + response

---
 rauthy-models/src/entity/users.rs | 46 +++++++++++++++++--------------
 rauthy-models/src/request.rs      |  4 ++-
 rauthy-models/src/response.rs     |  5 ++--
 3 files changed, 31 insertions(+), 24 deletions(-)

diff --git a/rauthy-models/src/entity/users.rs b/rauthy-models/src/entity/users.rs
index 8beb5b24..70bd5c00 100644
--- a/rauthy-models/src/entity/users.rs
+++ b/rauthy-models/src/entity/users.rs
@@ -296,29 +296,31 @@ impl User {
         }
 
         let lang = self.language.as_str();
-        let q = sqlx::query(r#"update users set
+        let q = sqlx::query(
+            r#"update users set
             email = $1, given_name = $2, family_name = $3, password = $4, roles = $5, groups = $6,
-            enabled = $7, email_verified = $8, password_expires = $9, created_at = $10, last_login = $11,
-            last_failed_login = $12, failed_login_attempts = $13, language = $14,
+            enabled = $7, email_verified = $8, password_expires = $9, created_at = $10,
+            last_login = $11, last_failed_login = $12, failed_login_attempts = $13, language = $14,
             webauthn_user_id = $15, user_expires = $16
-            where id = $17"#)
-            .bind(&self.email)
-            .bind(&self.given_name)
-            .bind(&self.family_name)
-            .bind(&self.password)
-            .bind(&self.roles)
-            .bind(&self.groups)
-            .bind(self.enabled)
-            .bind(self.email_verified)
-            .bind(self.password_expires)
-            .bind(self.created_at)
-            .bind(self.last_login)
-            .bind(self.last_failed_login)
-            .bind(self.failed_login_attempts)
-            .bind(lang)
-            .bind(&self.webauthn_user_id)
-            .bind(self.user_expires)
-            .bind(&self.id);
+            where id = $17"#,
+        )
+        .bind(&self.email)
+        .bind(&self.given_name)
+        .bind(&self.family_name)
+        .bind(&self.password)
+        .bind(&self.roles)
+        .bind(&self.groups)
+        .bind(self.enabled)
+        .bind(self.email_verified)
+        .bind(self.password_expires)
+        .bind(self.created_at)
+        .bind(self.last_login)
+        .bind(self.last_failed_login)
+        .bind(self.failed_login_attempts)
+        .bind(lang)
+        .bind(&self.webauthn_user_id)
+        .bind(self.user_expires)
+        .bind(&self.id);
 
         if let Some(txn) = txn {
             q.execute(&mut **txn).await?;
@@ -412,6 +414,7 @@ impl User {
 
         user.enabled = upd_user.enabled;
         user.email_verified = upd_user.email_verified;
+        user.user_expires = upd_user.user_expires;
 
         user.save(data, old_email, None).await?;
         Ok(user)
@@ -468,6 +471,7 @@ impl User {
             groups,
             enabled: user.enabled,
             email_verified: user.email_verified,
+            user_expires: user.user_expires,
         };
 
         User::update(data, id, req, Some(user)).await
diff --git a/rauthy-models/src/request.rs b/rauthy-models/src/request.rs
index 40c4e418..028f1d1b 100644
--- a/rauthy-models/src/request.rs
+++ b/rauthy-models/src/request.rs
@@ -16,7 +16,7 @@ use validator::{Validate, ValidationError};
 
 #[derive(Debug, Deserialize, Validate, ToSchema)]
 pub struct AuthCodeRequest {
-    // Validation: `^[a-z0-9-_/]{2,128}$`
+    /// Validation: `^[a-z0-9-_/]{2,128}$`
     #[validate(regex(path = "RE_LOWERCASE", code = "^[a-z0-9-_/]{2,128}$"))]
     pub grant_type: String,
     /// Validation: `[a-zA-Z0-9]`
@@ -526,6 +526,8 @@ pub struct UpdateUserRequest {
     pub groups: Option<Vec<String>>,
     pub enabled: bool,
     pub email_verified: bool,
+    #[validate(range(min = 1672527600, max = 4070905200))]
+    pub user_expires: Option<i64>,
 }
 
 #[derive(Debug, Serialize, Deserialize, Validate, ToSchema)]
diff --git a/rauthy-models/src/response.rs b/rauthy-models/src/response.rs
index 0787452d..f6b55946 100644
--- a/rauthy-models/src/response.rs
+++ b/rauthy-models/src/response.rs
@@ -339,7 +339,8 @@ pub struct UserResponse {
     pub last_failed_login: Option<i64>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub failed_login_attempts: Option<i64>,
-    pub webauthn_user_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub user_expires: Option<i64>,
 }
 
 impl From<User> for UserResponse {
@@ -366,7 +367,7 @@ impl From<User> for UserResponse {
             last_login: u.last_login,
             last_failed_login: u.last_failed_login,
             failed_login_attempts: u.failed_login_attempts,
-            webauthn_user_id: u.webauthn_user_id.map(|id| id.to_string()),
+            user_expires: u.user_expires,
         }
     }
 }

From a61ac69be0d3f19b12948a099b9c5db0e6be3aac Mon Sep 17 00:00:00 2001
From: sebadob <sebastiandobe@mailbox.org>
Date: Tue, 26 Sep 2023 11:45:07 +0200
Subject: [PATCH 3/6] expire new sessions + tokens early with
 Some(user_expires)

---
 rauthy-handlers/src/oidc.rs          |  2 +-
 rauthy-models/src/entity/sessions.rs | 83 +++++++++++++++++++++++-----
 rauthy-models/src/entity/users.rs    | 22 +++++++-
 rauthy-service/src/auth.rs           | 17 +++++-
 rauthy-service/src/token_set.rs      | 21 ++++++-
 5 files changed, 124 insertions(+), 21 deletions(-)

diff --git a/rauthy-handlers/src/oidc.rs b/rauthy-handlers/src/oidc.rs
index b6ef337a..8ae52581 100644
--- a/rauthy-handlers/src/oidc.rs
+++ b/rauthy-handlers/src/oidc.rs
@@ -82,7 +82,7 @@ pub async fn get_authorize(
             .body(body));
     }
 
-    let session = Session::new(None, *SESSION_LIFETIME, real_ip_from_req(&req));
+    let session = Session::new(*SESSION_LIFETIME, real_ip_from_req(&req));
     session.save(&data).await?;
 
     let mut action = FrontendAction::None;
diff --git a/rauthy-models/src/entity/sessions.rs b/rauthy-models/src/entity/sessions.rs
index 6856aad3..fd76881c 100644
--- a/rauthy-models/src/entity/sessions.rs
+++ b/rauthy-models/src/entity/sessions.rs
@@ -275,27 +275,17 @@ impl Session {
 
 impl Session {
     /// exp_in will be the time in seconds when the session will expire
-    pub fn new(user: Option<&User>, exp_in: u32, remote_ip: Option<String>) -> Self {
+    pub fn new(exp_in: u32, remote_ip: Option<String>) -> Self {
         let id = get_rand(32);
         let csrf_token = get_rand(32);
-        let mut user_id: Option<String> = None;
-        let mut roles: Option<String> = None;
-        let mut groups: Option<String> = None;
-
-        if let Some(u) = user {
-            user_id = Some(u.id.clone());
-            roles = Some(u.roles.clone());
-            groups = u.groups.clone();
-        }
-
         let now = OffsetDateTime::now_utc();
 
         Self {
             id,
             csrf_token,
-            user_id,
-            roles,
-            groups,
+            user_id: None,
+            roles: None,
+            groups: None,
             is_mfa: false, // cannot be known at the creation stage
             state: SessionState::Init,
             exp: now
@@ -306,6 +296,56 @@ impl Session {
         }
     }
 
+    /// exp_in will be the time in seconds when the session will expire
+    pub fn try_new(
+        user: &User,
+        exp_in: u32,
+        remote_ip: Option<String>,
+    ) -> Result<Self, ErrorResponse> {
+        let id = get_rand(32);
+        let csrf_token = get_rand(32);
+        let user_id = Some(user.id.clone());
+        let roles = Some(user.roles.clone());
+        let groups = user.groups.clone();
+
+        let now = OffsetDateTime::now_utc();
+
+        // make sure to check the max session lifetime for expiring users
+        let exp = if let Some(ts) = user.user_expires {
+            if now.unix_timestamp() > ts {
+                return Err(ErrorResponse::new(
+                    ErrorResponseType::Forbidden,
+                    "User has expired".to_string(),
+                ));
+            } else {
+                let target = now
+                    .add(time::Duration::seconds(exp_in as i64))
+                    .unix_timestamp();
+                if ts < target {
+                    ts
+                } else {
+                    target
+                }
+            }
+        } else {
+            now.add(time::Duration::seconds(exp_in as i64))
+                .unix_timestamp()
+        };
+
+        Ok(Self {
+            id,
+            csrf_token,
+            user_id,
+            roles,
+            groups,
+            is_mfa: false, // cannot be known at the creation stage
+            state: SessionState::Init,
+            exp,
+            last_seen: now.unix_timestamp(),
+            remote_ip,
+        })
+    }
+
     pub fn client_cookie(&self) -> cookie::Cookie {
         let exp = cookie::Expiration::from(
             OffsetDateTime::from_unix_timestamp(self.exp)
@@ -446,6 +486,21 @@ impl Session {
             String::from("CSRF Token is not correct"),
         ))
     }
+
+    pub fn validate_user_expiry(&mut self, user: &User) -> Result<(), ErrorResponse> {
+        if let Some(ts) = user.user_expires {
+            if OffsetDateTime::now_utc().unix_timestamp() > ts {
+                return Err(ErrorResponse::new(
+                    ErrorResponseType::Forbidden,
+                    "User has expired".to_string(),
+                ));
+            } else if ts < self.exp {
+                self.exp = ts;
+            }
+        }
+
+        Ok(())
+    }
 }
 
 pub fn get_header_value<'a>(
diff --git a/rauthy-models/src/entity/users.rs b/rauthy-models/src/entity/users.rs
index 70bd5c00..2a5c440e 100644
--- a/rauthy-models/src/entity/users.rs
+++ b/rauthy-models/src/entity/users.rs
@@ -627,6 +627,18 @@ impl User {
         Ok(())
     }
 
+    pub fn check_expired(&self) -> Result<(), ErrorResponse> {
+        if let Some(ts) = self.user_expires {
+            if OffsetDateTime::now_utc().unix_timestamp() > ts {
+                return Err(ErrorResponse::new(
+                    ErrorResponseType::Forbidden,
+                    String::from("User has expired"),
+                ));
+            }
+        }
+        Ok(())
+    }
+
     pub fn delete_group(&mut self, group: &str) {
         if self.groups.is_none() {
             return;
@@ -923,7 +935,7 @@ mod tests {
 
     #[test]
     fn test_session_impl() {
-        let user = User {
+        let mut user = User {
             id: "123".to_string(),
             email: "admin@localhost.de".to_string(),
             given_name: "Admin".to_string(),
@@ -940,9 +952,13 @@ mod tests {
             failed_login_attempts: None,
             language: Language::En,
             webauthn_user_id: None,
-            user_expires: None,
+            user_expires: Some(OffsetDateTime::now_utc().unix_timestamp()),
         };
-        let session = Session::new(Some(&user), 1, None);
+        let session = Session::try_new(&user, 1, None);
+        assert!(session.is_err());
+
+        user.user_expires = None;
+        let session = Session::try_new(&user, 1, None).unwrap();
 
         assert_eq!(session.is_valid(10), true);
         // sessions are validated with second accuracy
diff --git a/rauthy-service/src/auth.rs b/rauthy-service/src/auth.rs
index 68aa06d3..62489918 100644
--- a/rauthy-service/src/auth.rs
+++ b/rauthy-service/src/auth.rs
@@ -728,6 +728,11 @@ async fn grant_type_code(
 
         session.last_seen = OffsetDateTime::now_utc().unix_timestamp();
         session.state = SessionState::Auth;
+        if let Err(err) = session.validate_user_expiry(&user) {
+            code.delete(data).await?;
+            return Err(err);
+        }
+        session.validate_user_expiry(&user)?;
         session.user_id = Some(user.id);
         session.roles = Some(user.roles);
         session.groups = user.groups;
@@ -760,6 +765,12 @@ async fn grant_type_credentials(
             String::from("'client_credentials' flow is allowed for confidential clients only"),
         ));
     }
+    if !client.enabled {
+        return Err(ErrorResponse::new(
+            ErrorResponseType::BadRequest,
+            String::from("client is disabled"),
+        ));
+    }
     let secret = client_secret.ok_or_else(|| {
         ErrorResponse::new(
             ErrorResponseType::BadRequest,
@@ -825,6 +836,7 @@ async fn grant_type_password(
             )
         })?;
     user.check_enabled()?;
+    user.check_expired()?;
 
     match user.validate_password(data, password.clone()).await {
         Ok(_) => {
@@ -1405,9 +1417,12 @@ pub async fn validate_refresh_token(
         ));
     }
 
+    let mut user = User::find(data, uid).await?;
+    user.check_enabled()?;
+    user.check_expired()?;
+
     // at this point, everything has been validated -> we can issue a new TokenSet safely
     debug!("Refresh Token - all good!");
-    let mut user = User::find(data, uid).await?;
 
     // set last login
     user.last_login = Some(OffsetDateTime::now_utc().unix_timestamp());
diff --git a/rauthy-service/src/token_set.rs b/rauthy-service/src/token_set.rs
index b189d1ba..ec89aa0f 100644
--- a/rauthy-service/src/token_set.rs
+++ b/rauthy-service/src/token_set.rs
@@ -1,7 +1,7 @@
 use crate::auth;
 use actix_web::web;
 use rauthy_common::constants::{OFFLINE_TOKEN_LT, TOKEN_BEARER};
-use rauthy_common::error_response::ErrorResponse;
+use rauthy_common::error_response::{ErrorResponse, ErrorResponseType};
 use rauthy_models::app_state::AppState;
 use rauthy_models::entity::clients::Client;
 use rauthy_models::entity::scopes::Scope;
@@ -9,6 +9,7 @@ use rauthy_models::entity::user_attr::UserAttrValueEntity;
 use rauthy_models::entity::users::User;
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
+use time::OffsetDateTime;
 use utoipa::ToSchema;
 
 #[derive(Debug, Serialize, Deserialize, ToSchema)]
@@ -114,7 +115,23 @@ impl TokenSet {
         };
 
         // set the correct lifetime
-        let lifetime = if scope.contains("offline_access") {
+        let lifetime = if let Some(ts) = user.user_expires {
+            let now = OffsetDateTime::now_utc().unix_timestamp();
+            let diff = ts - now;
+            if diff < 1 {
+                return Err(ErrorResponse::new(
+                    ErrorResponseType::Forbidden,
+                    "User has expired".to_string(),
+                ));
+            }
+
+            let client_lt = client.access_token_lifetime.unsigned_abs() as i64;
+            if client_lt < diff {
+                client_lt
+            } else {
+                diff
+            }
+        } else if scope.contains("offline_access") {
             *OFFLINE_TOKEN_LT
         } else {
             client.access_token_lifetime.unsigned_abs() as i64

From d07f2ca6774d8b54f104efa0f750cf2a5acdf24b Mon Sep 17 00:00:00 2001
From: sebadob <sebastiandobe@mailbox.org>
Date: Tue, 26 Sep 2023 12:43:34 +0200
Subject: [PATCH 4/6] user expiry checker scheduler

---
 rauthy-main/src/schedulers.rs        | 91 +++++++++++++++++++++++++++-
 rauthy-models/src/entity/sessions.rs |  1 +
 rauthy-models/src/entity/users.rs    | 13 ++++
 rauthy.cfg                           | 10 +++
 4 files changed, 114 insertions(+), 1 deletion(-)

diff --git a/rauthy-main/src/schedulers.rs b/rauthy-main/src/schedulers.rs
index 2bf6b472..7a39c40f 100644
--- a/rauthy-main/src/schedulers.rs
+++ b/rauthy-main/src/schedulers.rs
@@ -5,6 +5,8 @@ use rauthy_common::DbType;
 use rauthy_models::app_state::{AppState, DbPool};
 use rauthy_models::email::send_pwd_reset_info;
 use rauthy_models::entity::jwk::Jwk;
+use rauthy_models::entity::refresh_tokens::RefreshToken;
+use rauthy_models::entity::sessions::Session;
 use rauthy_models::entity::users::User;
 use rauthy_models::migration::backup_db;
 use redhac::cache_del;
@@ -31,7 +33,8 @@ pub async fn scheduler_main(data: web::Data<AppState>) {
     tokio::spawn(refresh_tokens_cleanup(data.db.clone()));
     tokio::spawn(sessions_cleanup(data.db.clone()));
     tokio::spawn(jwks_cleanup(data.clone()));
-    tokio::spawn(password_expiry_checker(data));
+    tokio::spawn(password_expiry_checker(data.clone()));
+    tokio::spawn(user_expiry_checker(data));
 }
 
 // TODO -> adapt to RDBMS
@@ -189,6 +192,92 @@ pub async fn password_expiry_checker(data: web::Data<AppState>) {
     }
 }
 
+// Checks for expired users
+pub async fn user_expiry_checker(data: web::Data<AppState>) {
+    let secs = env::var("SCHED_USER_EXP_MINS")
+        .unwrap_or_else(|_| "60".to_string())
+        .parse::<u64>()
+        .expect("Cannot parse 'SCHED_USER_EXP_MINS' to u64");
+    let mut interval = time::interval(Duration::from_secs(secs * 60));
+    let cleanup_after_secs = env::var("SCHED_USER_EXP_DELETE_MINS")
+        .map(|s| {
+            s.parse::<u64>()
+                .expect("Cannot parse 'SCHED_USER_EXP_DELETE_MINS' to u64")
+                * 60
+        })
+        .ok();
+
+    loop {
+        interval.tick().await;
+        debug!("Running user_expiry_checker scheduler");
+
+        match User::find_expired(&data).await {
+            Ok(users) => {
+                let now = OffsetDateTime::now_utc().unix_timestamp();
+                // could possibly be optimized (if necessary) by collecting all IDs and use a
+                // non-prepared statement
+                for user in users {
+                    debug!("Found expired user {}: {}", user.id, user.email);
+
+                    let exp_ts = if let Some(ts) = user.user_expires {
+                        if now < ts {
+                            error!("Got not yet expired user in user_expiry_checker - this should never happen");
+                            continue;
+                        }
+                        ts
+                    } else {
+                        error!("Got non-expiring user in user_expiry_checker - this should never happen");
+                        continue;
+                    };
+
+                    // invalidate all sessions
+                    if let Err(err) = Session::invalidate_for_user(&data, &user.id).await {
+                        error!(
+                            "Error invalidating sessions for user {}: {:?}",
+                            user.id, err
+                        );
+                    }
+
+                    // invalidate all refresh tokens
+                    if let Err(err) = RefreshToken::invalidate_for_user(&data, &user.id).await {
+                        error!(
+                            "Error invalidating refresh tokens for user {}: {:?}",
+                            user.id, err
+                        );
+                    }
+
+                    debug!("cleanup_after_secs {:?}", cleanup_after_secs);
+                    // possibly auto-cleanup expired user
+                    if let Some(secs) = cleanup_after_secs {
+                        let expired_since_secs = (exp_ts - now).abs() as u64;
+                        debug!(
+                            "expired_since_secs > sec: {} > {}",
+                            expired_since_secs, secs
+                        );
+                        if expired_since_secs > secs {
+                            info!(
+                                "Auto cleanup for user {} after being expired for {} minutes",
+                                user.id,
+                                expired_since_secs / 60
+                            );
+                            if let Err(err) = user.delete(&data).await {
+                                error!(
+                                    "Error during auto cleanup - deleting user {}: {:?}",
+                                    user.id, err
+                                );
+                            }
+                        }
+                    }
+                }
+            }
+
+            Err(err) => {
+                error!("user_expiry_checker error: {}", err.message);
+            }
+        };
+    }
+}
+
 // Cleans up old / expired / already used Refresh Tokens
 pub async fn refresh_tokens_cleanup(db: DbPool) {
     let mut interval = time::interval(Duration::from_secs(3600 * 3));
diff --git a/rauthy-models/src/entity/sessions.rs b/rauthy-models/src/entity/sessions.rs
index fd76881c..1f4bbbf6 100644
--- a/rauthy-models/src/entity/sessions.rs
+++ b/rauthy-models/src/entity/sessions.rs
@@ -182,6 +182,7 @@ impl Session {
         Ok(())
     }
 
+    // TODO is using old KV store logic - could be optimized
     /// Invalidates all sessions for the given user_id by setting the expiry to `now()`
     pub async fn invalidate_for_user(
         data: &web::Data<AppState>,
diff --git a/rauthy-models/src/entity/users.rs b/rauthy-models/src/entity/users.rs
index 2a5c440e..a97bce55 100644
--- a/rauthy-models/src/entity/users.rs
+++ b/rauthy-models/src/entity/users.rs
@@ -284,6 +284,19 @@ impl User {
         Ok(res)
     }
 
+    pub async fn find_expired(data: &web::Data<AppState>) -> Result<Vec<Self>, ErrorResponse> {
+        let now = OffsetDateTime::now_utc()
+            .add(time::Duration::seconds(10))
+            .unix_timestamp();
+        tracing::debug!("User::find_expired - now: {}", now);
+        let res = sqlx::query_as::<_, Self>("select * from users where user_expires < $1")
+            .bind(now)
+            .fetch_all(&data.db)
+            .await?;
+        tracing::debug!("User::find_expired - users: {:?}", res);
+        Ok(res)
+    }
+
     // Saves a user
     pub async fn save(
         &self,
diff --git a/rauthy.cfg b/rauthy.cfg
index efc55b7b..66619244 100644
--- a/rauthy.cfg
+++ b/rauthy.cfg
@@ -112,6 +112,16 @@ CACHE_RECONNECT_TIMEOUT_UPPER=5000
 # Disables the housekeeping schedulers (default: false)
 #SCHED_DISABLE=true
 
+# The interval in minutes in which the scheduler for expired users should run.
+# If this finds expired users, it invalidates all existing sessions and refresh tokens for this user.
+# default: 60
+SCHED_USER_EXP_MINS=1
+
+# The threshold in minutes after which time the user expiry scheduler should automatically clean up expired users.
+# If not set at all, expired users will never be cleaned up automatically.
+# default: disabled / not set
+SCHED_USER_EXP_DELETE_MINS=2
+
 #####################################
 ############# E-MAIL ################
 #####################################

From 05b59f2b50dda095924bae5480ae8a758c68e41d Mon Sep 17 00:00:00 2001
From: sebadob <sebastiandobe@mailbox.org>
Date: Tue, 26 Sep 2023 12:43:57 +0200
Subject: [PATCH 5/6] date conversion fixes between local and utc ts

---
 frontend/src/components/admin/users/UserInfo.svelte | 2 +-
 frontend/src/utils/helpers.js                       | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/frontend/src/components/admin/users/UserInfo.svelte b/frontend/src/components/admin/users/UserInfo.svelte
index af00c1c6..a663b751 100644
--- a/frontend/src/components/admin/users/UserInfo.svelte
+++ b/frontend/src/components/admin/users/UserInfo.svelte
@@ -26,7 +26,7 @@
     let timer;
     let language = user.language.toUpperCase();
     let limitLifetime = !!user.user_expires;
-    let userExpires = limitLifetime ? formatDateToDateInput(new Date(user.user_expires * 1000)) : undefined;
+    let userExpires = limitLifetime ? formatDateFromTs(user.user_expires, true) : undefined;
 
     let allRoles = [];
     globalRolesNames.subscribe(rls => {
diff --git a/frontend/src/utils/helpers.js b/frontend/src/utils/helpers.js
index 4810bde8..ff791cec 100644
--- a/frontend/src/utils/helpers.js
+++ b/frontend/src/utils/helpers.js
@@ -148,11 +148,10 @@ export const formatUtcTsFromDateInput = inputDate => {
 	if (isNaN(d)) {
 		return;
 	}
-	const tzDiff = -new Date().getTimezoneOffset() * 60;
-	return d / 1000 + tzDiff;
+	return d / 1000;
 }
 
-export const formatDateFromTs = ts => {
+export const formatDateFromTs = (ts, fmtIso) => {
 	const utcOffsetMinutes = -new Date().getTimezoneOffset();
 	const d = new Date((ts + utcOffsetMinutes * 60) * 1000);
 
@@ -179,6 +178,9 @@ export const formatDateFromTs = ts => {
 		sc = '0' + sc;
 	}
 
+	if (fmtIso) {
+		return `${yyyy}-${mm}-${dd}T${hr}:${mn}:${sc}`;
+	}
 	return `${yyyy}/${mm}/${dd} ${hr}:${mn}:${sc}`;
 }
 

From 33a70fae02da921bb68202fc9aa1a1f5fdc47f4b Mon Sep 17 00:00:00 2001
From: sebadob <sebastiandobe@mailbox.org>
Date: Tue, 26 Sep 2023 12:49:08 +0200
Subject: [PATCH 6/6] code + comments cleanup

---
 rauthy-main/src/schedulers.rs | 42 +++--------------------------------
 rauthy.cfg                    |  2 +-
 2 files changed, 4 insertions(+), 40 deletions(-)

diff --git a/rauthy-main/src/schedulers.rs b/rauthy-main/src/schedulers.rs
index 7a39c40f..ba534704 100644
--- a/rauthy-main/src/schedulers.rs
+++ b/rauthy-main/src/schedulers.rs
@@ -18,13 +18,6 @@ use std::time::Duration;
 use tokio::time;
 use tracing::{debug, error, info};
 
-/**
-The main scheduler function, where everything is defined.<br>
-I runs in its own thread and executes the schedulers synchronously - no async needed here.
-
-One important value is the SCHED_SLEEP_DURATION. This affects the graceful shutdown time of the
-application, if it is too high.
-*/
 pub async fn scheduler_main(data: web::Data<AppState>) {
     info!("Starting schedulers");
 
@@ -71,33 +64,6 @@ pub async fn db_backup(db: DbPool) {
     }
 }
 
-// // Cleans up old / expired / already used Authorization Codes
-// // Cleanup inside the cache is done automatically with a max entry lifetime of 300 seconds
-// pub async fn auth_codes_cleanup(data: web::Data<AppState>) {
-//     let mut interval = time::interval(Duration::from_secs(60 * 17));
-//
-//     loop {
-//         interval.tick().await;
-//
-//         debug!("Running auth_codes_cleanup scheduler");
-//         match DATA_STORE.scan_cf(Cf::AuthCodes).await {
-//             Ok(bytes) => {
-//                 let del = bytes
-//                     .iter()
-//                     .map(|(_, b)| bincode::deserialize::<AuthCode>(b).unwrap())
-//                     .filter(|code| code.exp < chrono::Local::now().naive_local())
-//                     .collect::<Vec<AuthCode>>();
-//                 for code in del {
-//                     if let Err(err) = code.delete(&data).await {
-//                         error!("Auth Code Cleanup Error: {}", err.message);
-//                     }
-//                 }
-//             }
-//             Err(err) => error!("AuthCodes cleanup scheduler error: {}", err.message),
-//         }
-//     }
-// }
-
 // Cleans up old / expired magic links and deletes users, that have never used their
 // 'set first ever password' magic link to keep the database clean in case of an open user registration.
 // Runs every 6 hours.
@@ -206,6 +172,9 @@ pub async fn user_expiry_checker(data: web::Data<AppState>) {
                 * 60
         })
         .ok();
+    if cleanup_after_secs.is_none() {
+        info!("Auto cleanup for expired users disabled");
+    }
 
     loop {
         interval.tick().await;
@@ -246,14 +215,9 @@ pub async fn user_expiry_checker(data: web::Data<AppState>) {
                         );
                     }
 
-                    debug!("cleanup_after_secs {:?}", cleanup_after_secs);
                     // possibly auto-cleanup expired user
                     if let Some(secs) = cleanup_after_secs {
                         let expired_since_secs = (exp_ts - now).abs() as u64;
-                        debug!(
-                            "expired_since_secs > sec: {} > {}",
-                            expired_since_secs, secs
-                        );
                         if expired_since_secs > secs {
                             info!(
                                 "Auto cleanup for user {} after being expired for {} minutes",
diff --git a/rauthy.cfg b/rauthy.cfg
index 66619244..6ce2c630 100644
--- a/rauthy.cfg
+++ b/rauthy.cfg
@@ -120,7 +120,7 @@ SCHED_USER_EXP_MINS=1
 # The threshold in minutes after which time the user expiry scheduler should automatically clean up expired users.
 # If not set at all, expired users will never be cleaned up automatically.
 # default: disabled / not set
-SCHED_USER_EXP_DELETE_MINS=2
+#SCHED_USER_EXP_DELETE_MINS=7200
 
 #####################################
 ############# E-MAIL ################