Merge pull request #177 from ppatrik/patch-3

Draft: feat: add 30s grace period for access token expiration

Author: fschmtt

src/Http/Client.php

@@ -68,7 +68,7 @@ public function request(string $method, string $path = '', array $options = []):
 
     public function isAuthorized(): bool
     {
-        return $this->tokenStorage->retrieveAccessToken()?->isExpired(new DateTime()) === false;
+        return $this->tokenStorage->retrieveAccessToken()?->isExpired((new DateTime())->add(new \DateInterval('PT30S'))) === false;
     }
 
     private function authorize(): void

tests/Unit/Http/ClientTest.php

@@ -121,6 +121,58 @@ public function testIsAuthorizedIfTokenStorageContainsUnexpiredAccessToken(): vo
         static::assertTrue($client->isAuthorized());
     }
 
+    public function testIsNotAuthorizedIfTokenExpiresWithinGracePeriod(): void
+    {
+        $accessToken = $this->generateToken((new DateTimeImmutable())->modify('+15 seconds'));
+
+        $tokenStorage = new InMemoryTokenStorage();
+        $tokenStorage->storeAccessToken($accessToken);
+
+        $client = new Client(
+            $this->keycloak,
+            $this->createMock(ClientInterface::class),
+            $tokenStorage,
+        );
+
+        static::assertFalse($client->isAuthorized());
+    }
+
+    public function testIsAuthorizedIfTokenExpiresAfterGracePeriod(): void
+    {
+        $accessToken = $this->generateToken((new DateTimeImmutable())->modify('+60 seconds'));
+
+        $tokenStorage = new InMemoryTokenStorage();
+        $tokenStorage->storeAccessToken($accessToken);
+
+        $client = new Client(
+            $this->keycloak,
+            $this->createMock(ClientInterface::class),
+            $tokenStorage,
+        );
+
+        static::assertTrue($client->isAuthorized());
+    }
+
+    public function testReAuthorizesWhenTokenIsWithinGracePeriod(): void
+    {
+        $expiringAccessToken = $this->generateToken((new DateTimeImmutable())->modify('+15 seconds'));
+        $refreshToken = $this->generateToken((new DateTimeImmutable())->modify('+1 hour'));
+
+        $tokenStorage = new InMemoryTokenStorage();
+        $tokenStorage->storeAccessToken($expiringAccessToken);
+        $tokenStorage->storeRefreshToken($refreshToken);
+
+        $guzzleClient = new GuzzleClient(['handler' => new MockHandler([
+            $this->generateTokenResponse(),
+            new Response(),
+        ])]);
+
+        $client = new Client($this->keycloak, $guzzleClient, $tokenStorage);
+        $client->request('GET', '/admin/realms');
+
+        static::assertNotEquals($expiringAccessToken->toString(), $tokenStorage->retrieveAccessToken()->toString());
+    }
+
     public function testAuthenticatesUsingConfiguredRealm(): void
     {
         $accessToken = $this->generateToken((new DateTimeImmutable())->modify('+1 hour'));