Function GetRefreshTokenDuration

backend/api/auth/header.go:63–97

(ctx context.Context, store *store.Store, licenseService *enterprise.LicenseService, workspaceID string)

}

func GetRefreshTokenDuration(ctx context.Context, store *store.Store, licenseService *enterprise.LicenseService, workspaceID string) time.Duration {
	refreshTokenDuration := DefaultRefreshTokenDuration

	// If the sign-in frequency control feature is not enabled, return default duration
	if err := licenseService.IsFeatureEnabled(ctx, workspaceID, v1pb.PlanFeature_FEATURE_TOKEN_DURATION_CONTROL); err != nil {
		return refreshTokenDuration
	}

	workspaceProfile, err := store.GetWorkspaceProfileSetting(ctx, workspaceID)
	if err != nil {
		return refreshTokenDuration
	}

	if workspaceProfile.GetRefreshTokenDuration().GetSeconds() > 0 {
		refreshTokenDuration = workspaceProfile.GetRefreshTokenDuration().AsDuration()
	}

	if err := licenseService.IsFeatureEnabled(ctx, workspaceID, v1pb.PlanFeature_FEATURE_PASSWORD_RESTRICTIONS); err != nil {
		return refreshTokenDuration
	}
	// Currently we implement the password rotation restriction in a simple way:
	// 1. Only check if users need to reset their password during login.
	// 2. For the 1st time login, if `RequireResetPasswordForFirstLogin` is true, `require_reset_password` in the response will be true
	// 3. Otherwise if the `PasswordRotation` exists, check the password last updated time to decide if the `require_reset_password` is true.
	// So we will use the minimum value between (`refreshTokenDuration`, `passwordRestriction.PasswordRotation`) to force to expire the token.
	passwordRestriction := workspaceProfile.GetPasswordRestriction()
	if passwordRestriction.GetPasswordRotation().GetSeconds() > 0 {
		passwordRotation := passwordRestriction.GetPasswordRotation().AsDuration()
		if passwordRotation.Seconds() < refreshTokenDuration.Seconds() {
			refreshTokenDuration = passwordRotation
		}
	}

	return refreshTokenDuration
}

// GetRefreshTokenCookie creates a cookie for the refresh token.
// token="" => unset (clears cookie)