Port: enforce IPSIE session_expiry ceiling in credentials managers (#983)

[pmathew92]

Summary

Ports the IPSIE session_expiry ceiling enforcement (originally PR #983 on main/3.x) onto the v4_development branch, following v4's structure and patterns. The feature reads an upstream-IdP–asserted absolute session ceiling (session_expiry, Unix seconds) from the ID token, pins it at login, and enforces it on every credentials read — clearing credentials and failing with SESSION_EXPIRED once the ceiling is reached. A refresh token can never extend a session past the ceiling.

Public API added

• Credentials.sessionExpiresAt: Long? — the enforced ceiling (Unix seconds), null when the connection does not emit the claim.
• CredentialsManagerException.SESSION_EXPIRED.

Behavior

• Ceiling read from the ID token at login and persisted (com.auth0.session_expiry), so it survives refreshes whose ID token omits the claim.
• saveCredentials rejects an already-expired session up front (validateSessionExpiryAtCreation).
• getCredentials / getSsoCredentials / getApiCredentials / hasValidCredentials clear credentials and fail with SESSION_EXPIRED past the ceiling.
• 30s negative clock-skew leeway; fails open on missing/malformed/implausibly-large (millisecond-magnitude) values.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ab84088f-92a2-4cef-99c1-a8162dddc6be

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch port/983-session-expiry-ceiling

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}