Device tokens expire and renew on use; the approval page shows the requester (closes #70) 60f11b71a740

-- oxygenhub#70: tokens from device sign-in expire, and each use renews

-- them (renew_ms: the lifetime a use extends the token to); a device code

-- keeps the address that asked for it, shown when it is approved.

ALTER TABLE tokens ADD COLUMN renew_ms INTEGER;

ALTER TABLE device_codes ADD COLUMN requester TEXT NOT NULL DEFAULT '';

- **Device tokens expire, and the approval page says where a request came from (#70).** A token from device sign-in lasts 90 days past its last use; Settings → Tokens shows its expiry, renewed on use. The `/device` page shows when the code was asked for and from which address (the client's, through the proxy when `behind_proxy` is set), and warns to approve only a code you started yourself. `DELETE /api/v1/user/token` revokes the token it is called with, which `oxy auth logout` uses.

/// How long a device's token lasts after its last use (oxygenhub#70).

pub const TOKEN_LIFE_MS: i64 = 90 * 24 * 3600 * 1000;

pub async fn code(

    State(app): State<Shared>,

    headers: axum::http::HeaderMap,

    extensions: axum::http::Extensions,

    Json(req): Json<CodeRequest>,

) -> Response {

    let requester = super::client_addr(&app, &headers, &extensions);

        match accounts::create_device_code(&app.db, &hash, &user, &client, &scopes.join(","), expires, &requester).await {

    // A device's token lasts while it is used: each use renews it.

    let expires = now + TOKEN_LIFE_MS;

    let made = match accounts::create_token(&app.db, account_id, &name, &token_hash, &d.approved_scopes, "", Some(expires)).await {

        Ok(t) => t,

        Err(e) => return oauth_error(StatusCode::INTERNAL_SERVER_ERROR, "server_error", &e.to_string()),

    };

    if let Err(e) = accounts::set_token_renewal(&app.db, made.id, TOKEN_LIFE_MS).await {

        "expires_in": TOKEN_LIFE_MS / 1000,

        .route("/user/token", axum::routing::delete(revoke_own_token))

/// The address a request came from: the client's, as the proxy reports

/// it when the hub is behind one (`server.behind_proxy`), else the peer's.

/// Only an address's characters are kept, so it is safe to show.

pub fn client_addr(app: &Shared, headers: &HeaderMap, extensions: &axum::http::Extensions) -> String {

    let from_proxy = || {

        ["cf-connecting-ip", "x-forwarded-for", "x-real-ip"]

            .iter()

            .find_map(|h| headers.get(*h).and_then(|v| v.to_str().ok()).and_then(|v| v.split(',').next()).map(|v| v.trim().to_string()))

    };

    let addr = if app.config.server.behind_proxy {

        from_proxy()

    } else {

        extensions.get::<axum::extract::ConnectInfo<std::net::SocketAddr>>().map(|c| c.0.ip().to_string())

    };

    addr.map(|a| a.chars().filter(|c| c.is_ascii_hexdigit() || matches!(c, '.' | ':')).take(45).collect()).unwrap_or_default()

}

/// `DELETE /api/v1/user/token`: revoke the token this request is made

/// with, as `oxy auth logout` does.

async fn revoke_own_token(State(app): State<Shared>, headers: HeaderMap) -> Result<StatusCode, ApiError> {

    let c = caller(&app, &headers).await?;

    let (Some(account), Some(id)) = (c.account.as_ref(), c.token_id) else {

        return Err(ApiError(StatusCode::UNAUTHORIZED, "revoking needs the personal access token to revoke".into()));

    };

    db::accounts::delete_token(&app.db, account.id, id).await?;

    db::accounts::audit(&app.db, Some(account), "token.revoke", &c.token, "").await.ok();

    Ok(StatusCode::NO_CONTENT)

}

    /// The personal access token's id, when one is used.

    pub token_id: Option<i64>,

        return Ok(Caller { account: None, scopes: vec![], site: false, token: String::new(), token_id: None });

            token_id: None,

            Ok(Caller {

                account,

                scopes: tok.scope_list().iter().map(|s| s.to_string()).collect(),

                site: false,

                token: tok.name.clone(),

                token_id: Some(tok.id),

            })

    /// A renewing token's lifetime: each use extends it to now plus this.

    pub renew_ms: Option<i64>,

/// Record a use; a renewing token's expiry moves to now plus its lifetime.

    sqlx::query(

        "UPDATE tokens SET last_used_ms = ?1, \

         expires_ms = CASE WHEN renew_ms IS NULL THEN expires_ms ELSE MAX(COALESCE(expires_ms, 0), ?1 + renew_ms) END \

         WHERE id = ?2",

    )

    .bind(now_ms())

    .bind(id)

    .execute(pool)

    .await?;

    Ok(())

}

/// Make a token renewing: it lasts `renew_ms` past its last use.

pub async fn set_token_renewal(pool: &Pool, id: i64, renew_ms: i64) -> sqlx::Result<()> {

    sqlx::query("UPDATE tokens SET renew_ms = ? WHERE id = ?").bind(renew_ms).bind(id).execute(pool).await?;

    /// The address that asked for the code, as the hub saw it.

    pub requester: String,

    requester: &str,

        "INSERT INTO device_codes (device_hash, user_code, client, scopes, created_ms, expires_ms, requester) VALUES (?, ?, ?, ?, ?, ?, ?) RETURNING *",

    .bind(requester)

        tasks.spawn(async move {

            axum::serve(listener, r.into_make_service_with_connect_info::<std::net::SocketAddr>()).await.map_err(anyhow::Error::from)

        });

        tasks.spawn(async move {

            axum_server::bind_rustls(addr, tls)

                .serve(r.into_make_service_with_connect_info::<std::net::SocketAddr>())

                .await

                .map_err(anyhow::Error::from)

        });

use super::{filters, Error, Page, Shell};

    // oxygenhub#70: a device's token expires, and each use renews it.

    assert!(tokens.body.contains("renewed on use"), "{}", tokens.body);

    // The token can revoke itself (oxy auth logout), and is then refused.

    let (st, _) = api(app, "DELETE", "/api/v1/user/token", Some(&token), None).await;

    assert_eq!(st, StatusCode::NO_CONTENT);

    let (st, _) = api(app, "GET", "/api/v1/user", Some(&token), None).await;

    assert_eq!(st, StatusCode::UNAUTHORIZED);

    let (st, _) = api(app, "DELETE", "/api/v1/user/token", None, None).await;

    assert_eq!(st, StatusCode::UNAUTHORIZED, "revoking needs a token");

  <p class="small">Code <code>{{ d.user_code }}</code>, asked for <time title="{{ d.created_ms|when_i }}">{{ d.created_ms|ago_i }}</time>{% if !d.requester.is_empty() %} from <code>{{ d.requester }}</code>{% endif %}.</p>

  <p class="warn small">Approve only a code you started yourself, just now, on your own device. If someone sent you this code or link, deny it: they are asking for access to your account.</p>

  <p class="small">The app gets a token with what you allow here. It expires after 90 days without use, and you can revoke it under Settings → Tokens.</p>

<td>{% if let Some(x) = t.expires_ms %}{{ x|when_i }}{% if t.renew_ms.is_some() %} <span class="mute small">renewed on use</span>{% endif %}{% else %}<span class="mute">never</span>{% endif %}</td>