feat: support clock skew leeway in hsa_created_at validation

When multiple systems are working together, clock skew can become an
issue especially when validating token start times. If the issuing
system clock is ahead of the validating system clock, it is possible
that the token always ends up being not yet valid when validation is
attempted.

It is fairly common industry practice to allow some leeway for clock
skew. For example JWT spec notes for the nbf (not before) claim that

> Implementers MAY provide for some small leeway, usually no more than a
> few minutes, to account for clock skew.

This commit adds a new setting HSA_CLOCK_SKEW_LEEWAY_SECONDS defaulting
to 60 seconds which allows the HSA to be created 60 seconds in the
future.

refs: HAUKI-694

Author: voneiden

hauki/settings.py

@@ -75,6 +75,7 @@ def get_git_revision_hash() -> str:
     MAIL_MAILGUN_DOMAIN=(str, ""),
     MAIL_MAILGUN_API=(str, ""),
     RESOURCE_DEFAULT_TIMEZONE=(str, None),
+    HSA_CLOCK_SKEW_LEEWAY_SECONDS=(int, 30),
 )
 
 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
@@ -393,3 +394,5 @@ def get_git_revision_hash() -> str:
             for i in range(64)
         ]
     )
+
+HSA_CLOCK_SKEW_LEEWAY_SECONDS = env("HSA_CLOCK_SKEW_LEEWAY_SECONDS")

hauki/test_settings.py

@@ -0,0 +1,3 @@
+from .settings import *  # noqa: F403
+
+HSA_CLOCK_SKEW_LEEWAY_SECONDS = 0

hours/authentication.py

@@ -1,8 +1,10 @@
 import hashlib
 import hmac
 import urllib.parse
+from datetime import timedelta
 
 from dateutil.parser import parse
+from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.db.models import Q
 from django.utils import timezone
@@ -135,7 +137,9 @@ def validate_params_and_signature(params) -> bool:
     try:
         created_at = parse(params["hsa_created_at"])
         try:
-            if created_at > timezone.now():
+            if created_at > timezone.now() + timedelta(
+                seconds=settings.HSA_CLOCK_SKEW_LEEWAY_SECONDS
+            ):
                 raise SignatureValidationError(_("Invalid hsa_created_at"))
         except TypeError:
             raise SignatureValidationError(_("Invalid hsa_created_at"))

hours/tests/test_hauki_signed_auth.py

@@ -3,6 +3,8 @@
 
 import pytest
 from django.urls import reverse
+from django.utils import timezone
+from freezegun import freeze_time
 from pytz import UTC
 from rest_framework.test import APIRequestFactory
 from rest_framework.views import APIView
@@ -73,6 +75,48 @@ def test_get_auth_required_header_invalid_created_at(
     assert str(response.data["detail"]) == "Invalid hsa_created_at"
 
 
+@pytest.mark.django_db
+@pytest.mark.parametrize(
+    "leeway,expected_response_code,expected_response_data_contains",
+    [(0, 403, "Invalid hsa_created_at"), (1, 200, "You are authenticated")],
+)
+def test_get_auth_required_header_clock_skew_leeway(
+    api_client,
+    data_source,
+    signed_auth_key_factory,
+    leeway,
+    expected_response_code,
+    expected_response_data_contains,
+    settings,
+):
+    signed_auth_key = signed_auth_key_factory(data_source=data_source)
+    url = reverse("auth_required_test-list")
+
+    now = timezone.now()
+    settings.HSA_CLOCK_SKEW_LEEWAY_SECONDS = leeway
+
+    with freeze_time(now):
+        data = {
+            "hsa_source": data_source.id,
+            "hsa_username": "test_user",
+            "hsa_created_at": (now + datetime.timedelta(seconds=1)).isoformat(),
+            "hsa_valid_until": (
+                now + datetime.timedelta(hours=1, seconds=1)
+            ).isoformat(),
+        }
+
+        source_string = join_params(data)
+        signature = calculate_signature(signed_auth_key.signing_key, source_string)
+
+        authz_string = "haukisigned " + urllib.parse.urlencode(
+            {**data, "hsa_signature": signature}
+        )
+
+        response = api_client.get(url, HTTP_AUTHORIZATION=authz_string)
+        assert response.status_code == expected_response_code
+        assert expected_response_data_contains in str(response.data)
+
+
 @pytest.mark.django_db
 def test_get_auth_required_header_timezone_missing_created_at(
     api_client, data_source, signed_auth_key_factory

pytest.ini

@@ -1,4 +1,4 @@
 [pytest]
-DJANGO_SETTINGS_MODULE = hauki.settings
+DJANGO_SETTINGS_MODULE = hauki.test_settings
 filterwarnings =
     ignore::django.utils.deprecation.RemovedInDjango50Warning