Add peer login expiration

management/server/account.go

@@ -93,6 +93,7 @@ type AccountManager interface {
 	GetDNSSettings(accountID string, userID string) (*DNSSettings, error)
 	SaveDNSSettings(accountID string, userID string, dnsSettingsToSave *DNSSettings) error
 	GetPeer(accountID, peerID, userID string) (*Peer, error)
+	UpdatePeerLastLogin(peerID string) error
 }
 
 type DefaultAccountManager struct {

management/server/grpcserver.go

@@ -201,29 +201,37 @@ func (s *GRPCServer) Sync(req *proto.EncryptedMessage, srv proto.ManagementServi
 	}
 }
 
+func (s *GRPCServer) validateToken(jwtToken string) (string, error) {
+	if s.jwtMiddleware == nil {
+		return "", status.Error(codes.Internal, "no jwt middleware set")
+	}
+
+	token, err := s.jwtMiddleware.ValidateAndParse(jwtToken)
+	if err != nil {
+		return "", status.Errorf(codes.Internal, "invalid jwt token, err: %v", err)
+	}
+	claims := s.jwtClaimsExtractor.FromToken(token)
+	// we need to call this method because if user is new, we will automatically add it to existing or create a new account
+	_, _, err = s.accountManager.GetAccountFromToken(claims)
+	if err != nil {
+		return "", status.Errorf(codes.Internal, "unable to fetch account with claims, err: %v", err)
+	}
+
+	return claims.UserId, nil
+}
+
 func (s *GRPCServer) registerPeer(peerKey wgtypes.Key, req *proto.LoginRequest) (*Peer, error) {
 	var (
 		reqSetupKey string
 		userID      string
+		err         error
 	)
 
 	if req.GetJwtToken() != "" {
 		log.Debugln("using jwt token to register peer")
-
-		if s.jwtMiddleware == nil {
-			return nil, status.Error(codes.Internal, "no jwt middleware set")
-		}
-
-		token, err := s.jwtMiddleware.ValidateAndParse(req.GetJwtToken())
+		userID, err = s.validateToken(req.JwtToken)
 		if err != nil {
-			return nil, status.Errorf(codes.Internal, "invalid jwt token, err: %v", err)
-		}
-		claims := s.jwtClaimsExtractor.FromToken(token)
-		userID = claims.UserId
-		// we need to call this method because if user is new, we will automatically add it to existing or create a new account
-		_, _, err = s.accountManager.GetAccountFromToken(claims)
-		if err != nil {
-			return nil, status.Errorf(codes.Internal, "unable to fetch account with claims, err: %v", err)
+			return nil, err
 		}
 	} else {
 		log.Debugln("using setup key to register peer")
@@ -359,9 +367,23 @@ func (s *GRPCServer) Login(ctx context.Context, req *proto.EncryptedMessage) (*p
 		}
 	}
 
+	// check if peer login has expired
 	expired, left := peer.LoginExpired(24 * time.Hour)
 	if peer.UserID != "" && expired {
-		return nil, status.Errorf(codes.PermissionDenied, "peer login has expired %v ago. Please log in once more", left)
+		// it might be that peer expired but user has logged in already, check token then
+		if loginReq.GetJwtToken() == "" {
+			return nil, status.Errorf(codes.PermissionDenied,
+				"peer login has expired %v ago. Please log in once more", left)
+		}
+		_, err = s.validateToken(loginReq.GetJwtToken())
+		if err != nil {
+			return nil, err
+		}
+
+		err = s.accountManager.UpdatePeerLastLogin(peer.ID)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	var sshKey []byte

management/server/peer.go

@@ -509,6 +509,37 @@ func (am *DefaultAccountManager) AddPeer(setupKey, userID string, peer *Peer) (*
 	return newPeer, nil
 }
 
+func (am *DefaultAccountManager) UpdatePeerLastLogin(peerID string) error {
+	account, err := am.Store.GetAccountByPeerID(peerID)
+	if err != nil {
+		return err
+	}
+
+	unlock := am.Store.AcquireAccountLock(account.Id)
+	defer unlock()
+
+	// ensure that we consider modification happened meanwhile (because we were outside the account lock when we fetched the account)
+	account, err = am.Store.GetAccount(account.Id)
+	if err != nil {
+		return err
+	}
+
+	peer := account.GetPeer(peerID)
+	if peer == nil {
+		return status.Errorf(status.NotFound, "peer with ID %s not found", peerID)
+	}
+
+	peer.LastLogin = time.Now()
+	account.UpdatePeer(peer)
+
+	err = am.Store.SaveAccount(account)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // UpdatePeerSSHKey updates peer's public SSH key
 func (am *DefaultAccountManager) UpdatePeerSSHKey(peerID string, sshKey string) error {