feat: custom client token ttl (#3206)

This change introduces a new endpoint that allows you to control how long client tokens last. Now you can configure the lifespan for each valid combination of Client, GrantType, and TokenType. See #3157 Co-authored-by: aeneasr <3372410+aeneasr@users.noreply.github.com> Co-authored-by: Andreas Bucksteeg <andreas@bucksteeg.de>
ory · Jul 28, 2022 · 9544c03 · 9544c03
1 parent c9be891
commit 9544c03
Show file tree

Hide file tree

Showing 214 changed files with 18,979 additions and 12,308 deletions.
diff --git a/.cobra.yaml b/.cobra.yaml
@@ -1,2 +1,2 @@
 author: Aeneas Rekkas <aeneas@ory.am>
-license: Apache License Version 2.0
+license: Apache License Version 2.0
diff --git a/.codeclimate.yml b/.codeclimate.yml
@@ -11,5 +11,5 @@ ratings:
     - "**.go"
 
 exclude_paths:
-- vendor/
-- sdk/
+  - vendor/
+  - sdk/
diff --git a/.github/labels.json b/.github/labels.json
@@ -2,72 +2,51 @@
   {
     "name": "package/persistence/sql",
     "color": "0A28FD",
-    "aliases": [
-      "sql"
-    ]
+    "aliases": ["sql"]
   },
   {
     "name": "package/sdk",
     "color": "0A28FD",
-    "aliases": [
-      "sdk"
-    ]
+    "aliases": ["sdk"]
   },
   {
     "name": "package/telemetry",
     "color": "0A28FD",
-    "aliases": [
-      "telemetry"
-    ]
+    "aliases": ["telemetry"]
   },
   {
     "name": "package/oidc",
     "color": "0A28FD",
-    "aliases": [
-      "oidc"
-    ]
+    "aliases": ["oidc"]
   },
   {
     "name": "package/consent",
     "color": "0A28FD",
-    "aliases": [
-      "consent"
-    ]
+    "aliases": ["consent"]
   },
   {
     "name": "package/oauth2",
     "color": "0A28FD",
-    "aliases": [
-      "oauth2"
-    ]
+    "aliases": ["oauth2"]
   },
   {
     "name": "package/client",
     "color": "0A28FD",
-    "aliases": [
-      "client"
-    ]
+    "aliases": ["client"]
   },
   {
     "name": "package/jwk",
     "color": "0A28FD",
-    "aliases": [
-      "jwk"
-    ]
+    "aliases": ["jwk"]
   },
   {
     "name": "package/cli",
     "color": "0A28FD",
-    "aliases": [
-      "cmd",
-      "config"
-    ]
+    "aliases": ["cmd", "config"]
   },
   {
     "name": "package/config",
     "color": "0A28FD",
-    "aliases": [
-      "config"
-    ]
+    "aliases": ["config"]
   }
 ]
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -38,13 +38,18 @@ If you're unsure about any of them, don't hesitate to ask. We're here to help!
 -->
 
 - [ ] I have read the [contributing guidelines](../blob/master/CONTRIBUTING.md).
-- [ ] I have referenced an issue containing the design document if my change introduces a new feature.
-- [ ] I am following the [contributing code guidelines](../blob/master/CONTRIBUTING.md#contributing-code).
+- [ ] I have referenced an issue containing the design document if my change
+      introduces a new feature.
+- [ ] I am following the
+      [contributing code guidelines](../blob/master/CONTRIBUTING.md#contributing-code).
 - [ ] I have read the [security policy](../security/policy).
-- [ ] I confirm that this pull request does not address a security vulnerability. 
-      If this pull request addresses a security. vulnerability, 
-      I confirm that I got green light (please contact [security@ory.sh](mailto:security@ory.sh)) from the maintainers to push the changes.
-- [ ] I have added tests that prove my fix is effective or that my feature works.
+- [ ] I confirm that this pull request does not address a security
+      vulnerability. If this pull request addresses a security. vulnerability, I
+      confirm that I got green light (please contact
+      [security@ory.sh](mailto:security@ory.sh)) from the maintainers to push
+      the changes.
+- [ ] I have added tests that prove my fix is effective or that my feature
+      works.
 - [ ] I have added or changed [the documentation](https://github.com/ory/docs).
 
 ## Further Comments

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -4,7 +4,7 @@ on:
     branches:
       - master
     tags:
-      - '*'
+      - "*"
   pull_request:
 
 # Cancel in-progress runs in current workflow.
@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 2
       - uses: actions/setup-go@v2
         with:
-          go-version: '^1.16.1'
+          go-version: "^1.16.1"
       - name: Start service
         run: ./test/conformance/start.sh
       - name: Run tests
@@ -146,8 +146,8 @@ jobs:
       - sdk-generate
     strategy:
       matrix:
-        database: ['memory', 'postgres', 'mysql', 'cockroach']
-        args: ['', '--jwt']
+        database: ["memory", "postgres", "mysql", "cockroach"]
+        args: ["", "--jwt"]
     services:
       postgres:
         image: postgres:9.6
@@ -270,7 +270,7 @@ jobs:
           mailchimp_list_id: f605a41b53
           mailchmip_segment_id: 6479481
           mailchimp_api_key: ${{ secrets.MAILCHIMP_API_KEY }}
-          draft: 'true'
+          draft: "true"
           ssh_key: ${{ secrets.ORY_BOT_SSH_KEY }}
 
   slack-approval-notification:
@@ -297,5 +297,5 @@ jobs:
           mailchimp_list_id: f605a41b53
           mailchmip_segment_id: 6479481
           mailchimp_api_key: ${{ secrets.MAILCHIMP_API_KEY }}
-          draft: 'false'
+          draft: "false"
           ssh_key: ${{ secrets.ORY_BOT_SSH_KEY }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -12,7 +12,7 @@ on:
     # The branches below must be a subset of the branches above
     branches: [master]
   schedule:
-    - cron: '0 11 * * 6'
+    - cron: "0 11 * * 6"
 
 jobs:
   analyze:
@@ -24,48 +24,48 @@ jobs:
       matrix:
         # Override automatic language detection by changing the below list
         # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
-        language: ['go', 'javascript']
+        language: ["go", "javascript"]
         # Learn more...
         # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
+      - name: Checkout repository
+        uses: actions/checkout@v2
+        with:
+          # We must fetch at least the immediate parents so that if this is
+          # a pull request then we can checkout the head.
+          fetch-depth: 2
 
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
+      # If this run was triggered by a pull request event, then checkout
+      # the head of the pull request instead of the merge commit.
+      - run: git checkout HEAD^2
+        if: ${{ github.event_name == 'pull_request' }}
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file. 
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+          # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v1
 
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 https://git.io/JvXDl
 
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
+      # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+      #    and modify them (or add more) to build your code if your project
+      #    uses a compiled language
 
-    #- run: |
-    #   make bootstrap
-    #   make release
+      #- run: |
+      #   make bootstrap
+      #   make release
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1
diff --git a/.github/workflows/cve-scan.yaml b/.github/workflows/cve-scan.yaml
@@ -2,12 +2,12 @@ name: Docker Image Scanners
 on:
   push:
     branches:
-      - 'master'
+      - "master"
     tags:
-      - 'v*.*.*'
+      - "v*.*.*"
   pull_request:
     branches:
-      - 'master'
+      - "master"
 
 jobs:
   scanners:
@@ -50,13 +50,13 @@ jobs:
         if: ${{ always() }}
         with:
           image-ref: oryd/hydra:${{ steps.vars.outputs.sha_short }}
-          format: 'table'
-          exit-code: '42'
+          format: "table"
+          exit-code: "42"
           ignore-unfixed: true
-          vuln-type: 'os,library'
-          severity: 'CRITICAL,HIGH'
+          vuln-type: "os,library"
+          severity: "CRITICAL,HIGH"
       - name: Dockle Linter
-        uses: erzz/dockle-action@v1.1.1
+        uses: erzz/dockle-action@v1.3.1
         if: ${{ always() }}
         with:
           image: oryd/hydra:${{ steps.vars.outputs.sha_short }}

diff --git a/.prettierignore b/.prettierignore
@@ -0,0 +1,3 @@
+.schema
+.snapshots
+spec
diff --git a/.schema/openapi/patches/oauth2.yaml b/.schema/openapi/patches/oauth2.yaml
@@ -6,3 +6,17 @@
   path: /components/schemas/consentRequestSession/properties/id_token/additionalProperties
 - op: remove
   path: /components/schemas/consentRequestSession/properties/id_token/type
+- op: replace
+  path: /components/schemas/nullDuration
+  value:
+    title: "Time duration"
+    description: "Specify a time duration in milliseconds, seconds, minutes, hours."
+    type: string
+    pattern: "^([0-9]+(ns|us|ms|s|m|h))*$"
+- op: replace
+  path: /components/schemas/NullDuration
+  value:
+    title: "Time duration"
+    description: "Specify a time duration in milliseconds, seconds, minutes, hours."
+    type: string
+    pattern: "^([0-9]+(ns|us|ms|s|m|h))*$"
-Original file line number
+Diff line change
@@ Expand Up / @@ -11,5 +11,5 @@ ratings: @@
         - "**.go"
     exclude_paths:
-    - vendor/
-    - sdk/
+      - vendor/
+      - sdk/