bharos commented on code in PR #15999:
URL: https://github.com/apache/iceberg/pull/15999#discussion_r3102627877
##########
core/src/test/java/org/apache/iceberg/rest/auth/TestOAuth2Util.java:
##########
@@ -135,4 +138,113 @@ public void testCredentialFlowForSessionRefresh() throws
IOException {
any());
}
}
+
+ @Test
+ void fromTokenResponseUsesChildTokenExpiry() {
+ // parent token expires at epoch second 7200 (= 7200000 ms)
+ String parentToken = tokenWithExp(7200);
+ // child token expires at epoch second 300 (= 300000 ms)
+ String childToken = tokenWithExp(300);
+
+ AuthConfig parentConfig =
+ AuthConfig.builder()
+ .token(parentToken)
+ .tokenType(OAuth2Properties.ACCESS_TOKEN_TYPE)
+ .keepRefreshed(false)
+ .build();
+ OAuth2Util.AuthSession parent = new OAuth2Util.AuthSession(Map.of(),
parentConfig);
+
assertThat(parent.expiresAtMillis()).isEqualTo(TimeUnit.SECONDS.toMillis(7200));
+
+ OAuthTokenResponse response =
+ OAuthTokenResponse.builder()
+ .withToken(childToken)
+ .withTokenType(BEARER)
+ .withIssuedTokenType(OAuth2Properties.ACCESS_TOKEN_TYPE)
+ .setExpirationInSeconds(300)
+ .build();
+
+ // pass null executor to skip scheduling
+ OAuth2Util.AuthSession child =
+ OAuth2Util.AuthSession.fromTokenResponse(
+ null, null, response, System.currentTimeMillis(), parent);
+ assertThat(child.expiresAtMillis())
+ .as("Child session should use the child token's exp, not the parent's")
+ .isEqualTo(TimeUnit.SECONDS.toMillis(300));
+ }
+
+ @Test
+ void fromTokenResponseOpaqueTokenDoesNotInheritParentExpiry() {
+ // parent token with JWT exp claim
+ String parentToken = tokenWithExp(7200);
+ // child token with no exp claim (opaque)
+ String childToken = "opaque-access-token";
+
+ AuthConfig parentConfig =
+ AuthConfig.builder()
+ .token(parentToken)
+ .tokenType(OAuth2Properties.ACCESS_TOKEN_TYPE)
+ .keepRefreshed(false)
+ .build();
+ OAuth2Util.AuthSession parent = new OAuth2Util.AuthSession(Map.of(),
parentConfig);
+
assertThat(parent.expiresAtMillis()).isEqualTo(TimeUnit.SECONDS.toMillis(7200));
+
+ OAuthTokenResponse response =
+ OAuthTokenResponse.builder()
+ .withToken(childToken)
+ .withTokenType(BEARER)
+ .withIssuedTokenType(OAuth2Properties.ACCESS_TOKEN_TYPE)
+ .setExpirationInSeconds(600)
+ .build();
Review Comment:
Done — extracted parentSession(), childTokenResponse(), and tokenWithExp()
helpers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
