Class: Gitlab::Auth::Oidc::StepUpAuthExpirationValidator

Inherits:
Object
  • Object
show all
Defined in:
lib/gitlab/auth/oidc/step_up_auth_expiration_validator.rb

Overview

Validates expiration of step-up authentication sessions based on ID token exp claims

This validator handles time-based expiration for step-up authentication sessions using OIDC ID token exp claims.

Defined Under Namespace

Classes: Result

Class Method Summary collapse

Class Method Details

.validate(session_data) ⇒ Result

Main validation method that returns a Result struct

Parameters:

  • session_data (Hash) —

    the session data containing expiration information

Returns:

  • (Result) —

    validation result object



19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/gitlab/auth/oidc/step_up_auth_expiration_validator.rb', line 19

def validate(session_data)
  unless session_data.is_a?(Hash)
    return Result.new(
      valid?: false,
      expired?: false,
      message: 'No session data provided'
    )
  end

  exp_timestamp = session_data['exp_timestamp']
  unless exp_timestamp.present?
    return Result.new(
      valid?: false,
      expired?: false,
      message: 'No expiration timestamp in session'
    )
  end

  current_time = Time.current.to_i
  expired = current_time > exp_timestamp

  Result.new(
    valid?: true,
    expired?: expired,
    message: expired ? 'Session expired' : 'Session valid',
    current_time: current_time,
    exp_timestamp: exp_timestamp
  )
end