feat: add threshold in DateProvider

lib/ts/claims/primitiveArrayClaim.ts

@@ -33,6 +33,11 @@ export class PrimitiveArrayClaim<ValueType> {
             id?: string
         ): SessionClaimValidator => {
             const DateProvider = DateProviderReference.getReferenceOrThrow().dateProvider;
+            if (maxAgeInSeconds !== undefined && maxAgeInSeconds < DateProvider.getThresholdInSeconds()) {
+                throw new Error(
+                    `maxAgeInSeconds must be greater than the DateProvider threshold value -> ${DateProvider.getThresholdInSeconds()}`
+                );
+            }
             return {
                 id: id !== undefined ? id : this.id,
                 refresh: ctx => this.refresh(ctx),
@@ -75,6 +80,11 @@ export class PrimitiveArrayClaim<ValueType> {
             id?: string
         ): SessionClaimValidator => {
             const DateProvider = DateProviderReference.getReferenceOrThrow().dateProvider;
+            if (maxAgeInSeconds !== undefined && maxAgeInSeconds < DateProvider.getThresholdInSeconds()) {
+                throw new Error(
+                    `maxAgeInSeconds must be greater than the DateProvider threshold value -> ${DateProvider.getThresholdInSeconds()}`
+                );
+            }
             return {
                 id: id !== undefined ? id : this.id,
                 refresh: ctx => this.refresh(ctx),
@@ -121,6 +131,11 @@ export class PrimitiveArrayClaim<ValueType> {
             id?: string
         ): SessionClaimValidator => {
             const DateProvider = DateProviderReference.getReferenceOrThrow().dateProvider;
+            if (maxAgeInSeconds !== undefined && maxAgeInSeconds < DateProvider.getThresholdInSeconds()) {
+                throw new Error(
+                    `maxAgeInSeconds must be greater than the DateProvider threshold value -> ${DateProvider.getThresholdInSeconds()}`
+                );
+            }
             return {
                 id: id !== undefined ? id : this.id,
                 refresh: ctx => this.refresh(ctx),
@@ -164,6 +179,11 @@ export class PrimitiveArrayClaim<ValueType> {
             id?: string
         ): SessionClaimValidator => {
             const DateProvider = DateProviderReference.getReferenceOrThrow().dateProvider;
+            if (maxAgeInSeconds !== undefined && maxAgeInSeconds < DateProvider.getThresholdInSeconds()) {
+                throw new Error(
+                    `maxAgeInSeconds must be greater than the DateProvider threshold value -> ${DateProvider.getThresholdInSeconds()}`
+                );
+            }
             return {
                 id: id !== undefined ? id : this.id,
                 refresh: ctx => this.refresh(ctx),
@@ -211,6 +231,11 @@ export class PrimitiveArrayClaim<ValueType> {
             id?: string
         ): SessionClaimValidator => {
             const DateProvider = DateProviderReference.getReferenceOrThrow().dateProvider;
+            if (maxAgeInSeconds !== undefined && maxAgeInSeconds < DateProvider.getThresholdInSeconds()) {
+                throw new Error(
+                    `maxAgeInSeconds must be greater than the DateProvider threshold value -> ${DateProvider.getThresholdInSeconds()}`
+                );
+            }
             return {
                 id: id !== undefined ? id : this.id,
                 refresh: ctx => this.refresh(ctx),

lib/ts/claims/primitiveClaim.ts

@@ -36,10 +36,19 @@ export class PrimitiveClaim<ValueType> {
             return {
                 id: id !== undefined ? id : this.id,
                 refresh: ctx => this.refresh(ctx),
-                shouldRefresh: (payload, ctx) =>
-                    this.getValueFromPayload(payload, ctx) === undefined ||
-                    // We know payload[this.id] is defined since the value is not undefined in this branch
-                    (maxAgeInSeconds !== undefined && payload[this.id].t < DateProvider.now() - maxAgeInSeconds * 1000),
+                shouldRefresh: (payload, ctx) => {
+                    if (maxAgeInSeconds !== undefined && maxAgeInSeconds < DateProvider.getThresholdInSeconds()) {
+                        throw new Error(
+                            `maxAgeInSeconds must be greater than the DateProvider threshold value -> ${DateProvider.getThresholdInSeconds()}`
+                        );
+                    }
+                    return (
+                        this.getValueFromPayload(payload, ctx) === undefined ||
+                        // We know payload[this.id] is defined since the value is not undefined in this branch
+                        (maxAgeInSeconds !== undefined &&
+                            payload[this.id].t < DateProvider.now() - maxAgeInSeconds * 1000)
+                    );
+                },
                 validate: (payload, ctx) => {
                     const claimVal = this.getValueFromPayload(payload, ctx);
                     if (claimVal === undefined) {

lib/ts/fetch.ts

@@ -951,7 +951,7 @@ export const updateClockSkewUsingFrontToken = ({
     }
 
     const frontTokenPayload = parseFrontToken(frontToken);
-    const clockSkewInMillis = AuthHttpRequest.recipeImpl.getClockSkewInMillis({
+    const clockSkewInMillis = AuthHttpRequest.recipeImpl.calculateClockSkewInMillis({
         accessTokenPayload: frontTokenPayload.up,
         responseHeaders
     });

lib/ts/recipeImplementation.ts

@@ -311,25 +311,25 @@ export default function RecipeImplementation(recipeImplInput: {
             }
         },
 
-        getClockSkewInMillis: function ({
+        calculateClockSkewInMillis: function ({
             accessTokenPayload
         }: {
             accessTokenPayload: any;
             responseHeaders: Headers;
         }): number {
-            logDebugMessage("getClockSkewInMillis: called");
+            logDebugMessage("calculateClockSkewInMillis: called");
 
             const tokenIssuedAt = accessTokenPayload?.iat;
             if (tokenIssuedAt === undefined || typeof tokenIssuedAt !== "number") {
                 logDebugMessage(
-                    `getClockSkewInMillis: payload iat is undefined or not a number. This may happen due to an unsupported backend sdk. Returning 0`
+                    `calculateClockSkewInMillis: payload iat is undefined or not a number. This may happen due to an unsupported backend sdk. Returning 0`
                 );
                 return 0;
             }
 
             const estimatedServerTimeNow = tokenIssuedAt * 1000;
             const clockSkewInMillis = estimatedServerTimeNow - Date.now();
-            logDebugMessage("getClockSkewInMillis: returning " + clockSkewInMillis);
+            logDebugMessage("calculateClockSkewInMillis: returning " + clockSkewInMillis);
 
             return clockSkewInMillis;
         }

lib/ts/types.ts

@@ -153,7 +153,7 @@ export type RecipeInterface = {
         sessionTokenBackendDomain: string | undefined
     ): boolean;
 
-    getClockSkewInMillis(params: { accessTokenPayload: any; responseHeaders: Headers }): number;
+    calculateClockSkewInMillis(params: { accessTokenPayload: any; responseHeaders: Headers }): number;
 };
 
 export type ClaimValidationResult = { isValid: true } | { isValid: false; reason?: any };

lib/ts/utils/dateProvider/defaultImplementation.ts

@@ -19,6 +19,9 @@ export class DateProvider {
     private static instance?: DateProvider;
     public static readonly CLOCK_SKEW_KEY = "__st_clockSkewInMillis";
     private clockSkewInMillis: number = 0;
+    // Ensure a meaningful clock skew value by setting a threshold. Omitting a threshold would invariably lead to some
+    // clock skew due to server-client latency, arising from the time it takes for the token to arrive after being issued.
+    private thresholdInSeconds = 7;
 
     // The static init method is used to create a singleton instance of DateProvider,
     // as we require access to localStorage for initializing clockSkewInMillis.
@@ -56,8 +59,16 @@ export class DateProvider {
         return DateProvider.instance;
     }
 
+    getThresholdInSeconds(): number {
+        return this.thresholdInSeconds;
+    }
+
+    setThresholdInSeconds(thresholdInSeconds: number): void {
+        this.thresholdInSeconds = thresholdInSeconds;
+    }
+
     setClientClockSkewInMillis(clockSkewInMillis: number): void {
-        this.clockSkewInMillis = clockSkewInMillis;
+        this.clockSkewInMillis = Math.abs(clockSkewInMillis) > this.thresholdInSeconds * 1000 ? clockSkewInMillis : 0;
         const localStorage = WindowHandlerReference.getReferenceOrThrow().windowHandler.localStorage;
         localStorage.setItemSync(DateProvider.CLOCK_SKEW_KEY, String(clockSkewInMillis));
     }