refac

Author: taylorwilsdon

auth/auth_info_middleware.py

@@ -8,6 +8,7 @@
 from fastmcp.server.dependencies import get_access_token
 from fastmcp.server.dependencies import get_http_headers
 
+from auth.external_oauth_provider import SESSION_TIME
 from auth.oauth21_session_store import ensure_session_from_access_token
 from auth.oauth_types import WorkspaceAccessToken
 
@@ -117,6 +118,9 @@ async def _process_request_for_auth(self, context: MiddlewareContext):
                                         else:
                                             # Standard GoogleProvider returns a base AccessToken;
                                             # wrap it in WorkspaceAccessToken for identical downstream handling
+                                            verified_expires = getattr(
+                                                verified_auth, "expires_at", None
+                                            )
                                             access_token = WorkspaceAccessToken(
                                                 token=token_str,
                                                 client_id=getattr(
@@ -128,10 +132,9 @@ async def _process_request_for_auth(self, context: MiddlewareContext):
                                                 )
                                                 or [],
                                                 session_id=f"google_oauth_{token_str[:8]}",
-                                                expires_at=getattr(
-                                                    verified_auth, "expires_at", None
-                                                )
-                                                or int(time.time()) + 3600,
+                                                expires_at=verified_expires
+                                                if verified_expires is not None
+                                                else int(time.time()) + SESSION_TIME,
                                                 claims=getattr(
                                                     verified_auth, "claims", {}
                                                 )

auth/external_oauth_provider.py

@@ -27,7 +27,25 @@
 GOOGLE_ISSUER_URL = "https://accounts.google.com"
 
 # Configurable session time in seconds (default: 1 hour)
-SESSION_TIME = int(os.getenv("SESSION_TIME", "3600"))
+_DEFAULT_SESSION_TIME = 3600
+
+
+def _get_session_time() -> int:
+    """Parse SESSION_TIME from environment with fallback and minimum clamp."""
+    raw = os.getenv("SESSION_TIME", "")
+    if not raw:
+        return _DEFAULT_SESSION_TIME
+    try:
+        value = int(raw)
+    except ValueError:
+        logger.warning(
+            "Invalid SESSION_TIME=%r, falling back to %d", raw, _DEFAULT_SESSION_TIME
+        )
+        return _DEFAULT_SESSION_TIME
+    return max(value, 1)
+
+
+SESSION_TIME = _get_session_time()
 
 
 class ExternalOAuthProvider(GoogleProvider):