Implement leeway for nbf and iat (#147)

Author: stidges

src/Objects/Values/SessionToken.php

@@ -306,6 +306,26 @@ public function getLeewayExpiration(): Carbon
         return (new Carbon($this->exp))->addSeconds(self::LEEWAY_SECONDS);
     }
 
+    /**
+     * Get the extended not before time with leeway of the token.
+     *
+     * @return Carbon
+     */
+    public function getLeewayNotBefore(): Carbon
+    {
+        return (new Carbon($this->nbf))->subSeconds(self::LEEWAY_SECONDS);
+    }
+
+    /**
+     * Get the extended issued at time with leeway of the token.
+     *
+     * @return Carbon
+     */
+    public function getLeewayIssuedAt(): Carbon
+    {
+        return (new Carbon($this->iat))->subSeconds(self::LEEWAY_SECONDS);
+    }
+
     /**
      * Checks the validity of the signature sent with the token.
      *
@@ -353,8 +373,8 @@ protected function verifyExpiration(): void
         $now = Carbon::now();
         Assert::thatAll([
             $now->greaterThan($this->getLeewayExpiration()),
-            $now->lessThan($this->nbf),
-            $now->lessThan($this->iat),
+            $now->lessThan($this->getLeewayNotBefore()),
+            $now->lessThan($this->getLeewayIssuedAt()),
         ])->false(self::EXCEPTION_EXPIRED);
     }
 }

tests/Objects/Values/SessionTokenTest.php

@@ -45,12 +45,6 @@ public function testShouldProcessForExpiredTokenStillInLeewayPeriod(): void
         $token = $this->buildToken(['exp' => (new Carbon($now))->subSeconds(SessionToken::LEEWAY_SECONDS - 2)]);
         $st = SessionToken::fromNative($token);
 
-        $this->assertInstanceOf(ShopDomainValue::class, $st->getShopDomain());
-        $this->assertTrue(Str::contains($this->tokenDefaults['dest'], $st->getShopDomain()->toNative()));
-
-        $this->assertInstanceOf(SessionIdValue::class, $st->getSessionId());
-        $this->assertSame($this->tokenDefaults['sid'], $st->getSessionId()->toNative());
-
         $this->assertInstanceOf(Carbon::class, $st->getLeewayExpiration());
         $this->assertTrue($now->unix() < $st->getLeewayExpiration()->unix());
         $this->assertTrue($st->getLeewayExpiration()->unix() - $now->unix() < SessionToken::LEEWAY_SECONDS);
@@ -64,6 +58,44 @@ public function testShouldThrowExceptionForExpiredTokenOutOfLeewayPeriod(): void
         SessionToken::fromNative($token);
     }
 
+    public function testShouldProcessForNotBeforeTokenStillInLeewayPeriod(): void
+    {
+        $now = Carbon::now();
+        $token = $this->buildToken(['nbf' => (new Carbon($now))->addSeconds(SessionToken::LEEWAY_SECONDS - 2)]);
+        $st = SessionToken::fromNative($token);
+
+        $this->assertInstanceOf(Carbon::class, $st->getLeewayNotBefore());
+        $this->assertTrue($now->unix() > $st->getLeewayNotBefore()->unix());
+        $this->assertTrue($st->getLeewayNotBefore()->unix() - $now->unix() < SessionToken::LEEWAY_SECONDS);
+    }
+
+    public function testShouldThrowExceptionForNotBeforeTokenOutOfLeewayPeriod(): void
+    {
+        $this->expectException(AssertionFailedException::class);
+
+        $token = $this->buildToken(['nbf' => Carbon::now()->addSeconds(SessionToken::LEEWAY_SECONDS + 2)]);
+        SessionToken::fromNative($token);
+    }
+
+    public function testShouldProcessForIssuedAtTokenStillInLeewayPeriod(): void
+    {
+        $now = Carbon::now();
+        $token = $this->buildToken(['iat' => (new Carbon($now))->addSeconds(SessionToken::LEEWAY_SECONDS - 2)]);
+        $st = SessionToken::fromNative($token);
+
+        $this->assertInstanceOf(Carbon::class, $st->getLeewayIssuedAt());
+        $this->assertTrue($now->unix() > $st->getLeewayIssuedAt()->unix());
+        $this->assertTrue($st->getLeewayIssuedAt()->unix() - $now->unix() < SessionToken::LEEWAY_SECONDS);
+    }
+
+    public function testShouldThrowExceptionForIssuedAtTokenOutOfLeewayPeriod(): void
+    {
+        $this->expectException(AssertionFailedException::class);
+
+        $token = $this->buildToken(['iat' => Carbon::now()->addSeconds(SessionToken::LEEWAY_SECONDS + 2)]);
+        SessionToken::fromNative($token);
+    }
+
     public function testShouldThrowExceptionForMalformedToken(): void
     {
         $this->expectException(AssertionFailedException::class);