fix(server): introspect session-bound refresh tokens against their session

533d177 added introspection's sessionAlive check and deliberately excluded
refresh tokens, because they outlive the session that issued them. 155557b
then let a client tie its refresh tokens to the session
(refreshTokenLifetime: session), and rewrote sessionAlive to gate on exactly
that flag. introspectAccessToken consults it; introspectRefreshToken never
did, so a session-bound refresh token introspects active after its session
has ended.

Explicit logout is covered: it eagerly deletes bound clients' tokens, so the
lookup fails. A session that ends by idle or absolute timeout revokes
nothing eagerly, and the token introspects active until its own expiry, even
though the refresh grant would refuse to redeem it.

Read the token's sid from its offline-session reference, the same source the
refresh grant uses, and apply the same sessionAlive check the access-token
path applies: a session-bound client whose session has ended introspects
inactive. A bound token whose offline session cannot be read is reported
inactive, matching the grant's refusal. Standalone clients are unchanged.

Signed-off-by: Sasha Mitchell <sash@ela.city>

Author: SashaMIT

server/introspection/introspection.go

@@ -94,8 +94,9 @@ type IntrospectionExtra struct {
 	// token at all when sessions are disabled.
 	//
 	// Note what this does not mean: introspection reports on the token, not on the
-	// session. A token from a session that has since ended still introspects as
-	// active until it expires, because nothing here consults session storage.
+	// session. For a standalone client a token from a session that has since ended
+	// still introspects as active until it expires. For a session-bound client the
+	// ended session takes the token with it, and introspection reports inactive.
 	SessionID string `json:"sid,omitempty"`
 
 	Email         string `json:"email,omitempty"`
@@ -260,6 +261,34 @@ func (h *Handler) introspectRefreshToken(ctx context.Context, token string) (*In
 		return nil, newIntrospectInternalServerError()
 	}
 
+	client, err := h.Storage.GetClient(ctx, refresh.ClientID)
+	if err != nil {
+		h.Logger.ErrorContext(ctx, "error while fetching client from storage", "err", err.Error())
+		return nil, newIntrospectInternalServerError()
+	}
+
+	// A refresh token's sid lives on its offline-session reference, read the same
+	// way the refresh grant reads it: the two must agree on whether the session
+	// the token is bound to still stands.
+	var sessionID string
+	offlineSessions, err := h.Storage.GetOfflineSessions(ctx, refresh.Claims.UserID, refresh.ConnectorID)
+	if err != nil {
+		if !errors.Is(err, storage.ErrNotFound) {
+			h.Logger.ErrorContext(ctx, "failed to read offline session for sid", "err", err)
+		}
+		if client.RefreshBoundToSession() {
+			// The grant refuses a bound token whose session cannot be read;
+			// introspection reports it inactive.
+			return nil, newIntrospectInactiveTokenError()
+		}
+	} else if ref, ok := offlineSessions.Refresh[refresh.ClientID]; ok {
+		sessionID = ref.SessionID
+	}
+
+	if !h.sessionAlive(ctx, client, subjectString, sessionID) {
+		return nil, newIntrospectInactiveTokenError()
+	}
+
 	return &Introspection{
 		Active:    true,
 		ClientID:  refresh.ClientID,

server/server_introspection_test.go

@@ -257,3 +257,67 @@ func TestHandleIntrospect(t *testing.T) {
 		})
 	}
 }
+
+// A session-bound client's refresh token must introspect as inactive once the
+// session it was issued under has ended, the same judgment the refresh grant
+// makes. A standalone client's token outlives the session by design.
+func TestHandleIntrospectRefreshTokenSessionBinding(t *testing.T) {
+	ctx := t.Context()
+
+	httpServer, s := newTestServerWithSessions(t, nil)
+	defer httpServer.Close()
+
+	mockTestStorage(t, s.storage)
+
+	// The refresh token was issued under a browser session.
+	require.NoError(t, s.storage.UpdateOfflineSessions(ctx, "1", "test",
+		func(old storage.OfflineSessions) (storage.OfflineSessions, error) {
+			old.Refresh["test"].SessionID = "sid"
+			return old, nil
+		}))
+
+	// That session has since ended by timeout: the row is still stored, but both
+	// expiries are in the past.
+	past := time.Now().Add(-time.Hour)
+	require.NoError(t, s.storage.CreateAuthSession(ctx, storage.AuthSession{
+		ID: "sid", Secret: testSessionSecret("sid"),
+		UserID: "1", ConnectorID: "test",
+		CreatedAt: past, LastActivity: past,
+		AbsoluteExpiry: past, IdleExpiry: past,
+	}))
+
+	refreshToken, err := internal.Marshal(&internal.RefreshToken{RefreshId: "test", Token: "bar"})
+	require.NoError(t, err)
+
+	introspect := func() string {
+		data := url.Values{}
+		data.Set("token", refreshToken)
+
+		u, err := url.Parse(s.issuerURL.String())
+		require.NoError(t, err)
+		u.Path = path.Join(u.Path, "token", "introspect")
+
+		req, _ := http.NewRequest("POST", u.String(), bytes.NewBufferString(data.Encode()))
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+		rr := httptest.NewRecorder()
+		s.ServeHTTP(rr, req)
+		require.Equal(t, http.StatusOK, rr.Code)
+
+		result, err := io.ReadAll(rr.Body)
+		require.NoError(t, err)
+		return string(result)
+	}
+
+	// Standalone client: the ended session changes nothing.
+	require.Contains(t, introspect(), `"active":true`)
+
+	require.NoError(t, s.storage.UpdateClient(ctx, "test",
+		func(old storage.Client) (storage.Client, error) {
+			old.RefreshTokenLifetime = storage.RefreshTokenLifetimeSession
+			return old, nil
+		}))
+
+	// Session-bound client: the token ended with the session.
+	require.Equal(t, "{\"active\":false}\n", introspect())
+}