MM-23935 extend session expiry on user activity (#14275)

* MM-23935  extend session expiry on user activity

- if user types anything before a session expires the session will be extended to now + session length

- ensures new session expiries are not written to DB too frequently

- new session store func for updating session ExpiresAt

- session length defaults for mobile and web/ldap changed from 180 days to 30 days

app/session_test.go

@@ -4,12 +4,12 @@
 package app
 
 import (
+	"fmt"
 	"testing"
 
+	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	"github.com/mattermost/mattermost-server/v5/model"
 )
 
 func TestCache(t *testing.T) {
@@ -58,6 +58,7 @@ func TestGetSessionIdleTimeoutInMinutes(t *testing.T) {
 
 	th.App.SetLicense(model.NewTestLicense("compliance"))
 	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SessionIdleTimeoutInMinutes = 5 })
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.ExtendSessionLengthWithActivity = false })
 
 	rsession, err := th.App.GetSession(session.Token)
 	require.Nil(t, err)
@@ -177,3 +178,129 @@ func TestUpdateSessionOnPromoteDemote(t *testing.T) {
 		assert.Equal(t, "true", rsession.Props[model.SESSION_PROP_IS_GUEST])
 	})
 }
+
+const hourMillis int64 = 60 * 60 * 1000
+const dayMillis int64 = 24 * hourMillis
+
+func TestApp_GetSessionLengthInMillis(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SessionLengthMobileInDays = 3 })
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SessionLengthSSOInDays = 2 })
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SessionLengthWebInDays = 1 })
+
+	t.Run("get session length mobile", func(t *testing.T) {
+		session := &model.Session{
+			UserId:   model.NewId(),
+			DeviceId: model.NewId(),
+		}
+		session, err := th.App.CreateSession(session)
+		require.Nil(t, err)
+
+		sessionLength := th.App.GetSessionLengthInMillis(session)
+		require.Equal(t, dayMillis*3, sessionLength)
+	})
+
+	t.Run("get session length SSO", func(t *testing.T) {
+		session := &model.Session{
+			UserId:  model.NewId(),
+			IsOAuth: true,
+		}
+		session, err := th.App.CreateSession(session)
+		require.Nil(t, err)
+
+		sessionLength := th.App.GetSessionLengthInMillis(session)
+		require.Equal(t, dayMillis*2, sessionLength)
+	})
+
+	t.Run("get session length web/LDAP", func(t *testing.T) {
+		session := &model.Session{
+			UserId: model.NewId(),
+		}
+		session, err := th.App.CreateSession(session)
+		require.Nil(t, err)
+
+		sessionLength := th.App.GetSessionLengthInMillis(session)
+		require.Equal(t, dayMillis*1, sessionLength)
+	})
+}
+
+func TestApp_ExtendExpiryIfNeeded(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.ExtendSessionLengthWithActivity = true })
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SessionLengthMobileInDays = 3 })
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SessionLengthSSOInDays = 2 })
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SessionLengthWebInDays = 1 })
+
+	t.Run("expired session should not be extended", func(t *testing.T) {
+		expires := model.GetMillis() - hourMillis
+		session := &model.Session{
+			UserId:    model.NewId(),
+			ExpiresAt: expires,
+		}
+		session, err := th.App.CreateSession(session)
+		require.Nil(t, err)
+
+		ok := th.App.ExtendSessionExpiryIfNeeded(session)
+
+		require.False(t, ok)
+		require.Equal(t, expires, session.ExpiresAt)
+		require.True(t, session.IsExpired())
+	})
+
+	t.Run("session within threshold should not be extended", func(t *testing.T) {
+		session := &model.Session{
+			UserId: model.NewId(),
+		}
+		session, err := th.App.CreateSession(session)
+		require.Nil(t, err)
+
+		expires := model.GetMillis() + th.App.GetSessionLengthInMillis(session)
+		session.ExpiresAt = expires
+
+		ok := th.App.ExtendSessionExpiryIfNeeded(session)
+
+		require.False(t, ok)
+		require.Equal(t, expires, session.ExpiresAt)
+		require.False(t, session.IsExpired())
+	})
+
+	var tests = []struct {
+		name    string
+		session *model.Session
+	}{
+		{name: "mobile", session: &model.Session{UserId: model.NewId(), DeviceId: model.NewId(), Token: model.NewId()}},
+		{name: "SSO", session: &model.Session{UserId: model.NewId(), IsOAuth: true, Token: model.NewId()}},
+		{name: "web/LDAP", session: &model.Session{UserId: model.NewId(), Token: model.NewId()}},
+	}
+	for _, test := range tests {
+		t.Run(fmt.Sprintf("%s session beyond threshold should update ExpiresAt", test.name), func(t *testing.T) {
+			session, err := th.App.CreateSession(test.session)
+			require.Nil(t, err)
+
+			expires := model.GetMillis() + th.App.GetSessionLengthInMillis(session) - hourMillis
+			session.ExpiresAt = expires
+
+			ok := th.App.ExtendSessionExpiryIfNeeded(session)
+
+			require.True(t, ok)
+			require.Greater(t, session.ExpiresAt, expires)
+			require.False(t, session.IsExpired())
+
+			// check cache was updated
+			ts, ok := th.App.Srv().sessionCache.Get(session.Token)
+			require.True(t, ok)
+			cachedSession := ts.(*model.Session)
+			require.Equal(t, session.ExpiresAt, cachedSession.ExpiresAt)
+
+			// check database was updated.
+			storedSession, err := th.App.Srv().Store.Session().Get(session.Token)
+			require.Nil(t, err)
+			require.Equal(t, session.ExpiresAt, storedSession.ExpiresAt)
+		})
+	}
+
+}