Fixed nonsensical ladder

docs/CONFIGURATION.md

@@ -221,8 +221,9 @@ The security endpoints are `authorize`, `token`, `introspect`, `revoke`, `par`,
 | `argon2.iterations` | `2` |
 | `argon2.parallelism` | `1` |
 
-Every TTL must be non-zero. Argon2 memory must be at least 8192 KiB, with a
-non-zero iteration count and parallelism.
+Every TTL must be non-zero, and the access-token TTL must not exceed the
+refresh-token TTL. Argon2 memory must be at least 8192 KiB, with a non-zero
+iteration count and parallelism.
 
 ## Rate-limit keys
 

src/config.rs

@@ -307,6 +307,9 @@ pub enum ConfigError {
   /// A TTL was zero.
   #[error("invalid token TTL: every lifetime must be non-zero")]
   InvalidTtl,
+  /// The access-token lifetime exceeded the refresh-token lifetime.
+  #[error("invalid token TTL: access lifetime must not exceed the refresh lifetime")]
+  InvalidTtlLadder,
   /// A mounted secret file could not be read.
   #[error("failed to read secret file {path}: {source}")]
   SecretFile {

src/config/tests.rs

@@ -73,6 +73,15 @@ fn without_redis_durability() -> Map<String, Value> {
   map
 }
 
+fn with_ttl(access_secs: u64, refresh_secs: u64) -> Map<String, Value> {
+  let mut map = base();
+  map.insert(
+    "ttl".to_owned(),
+    json!({ "access_secs": access_secs, "refresh_secs": refresh_secs }),
+  );
+  map
+}
+
 #[test]
 fn config_loads_with_empty_scope_registry() -> Result<(), Box<dyn Error>> {
   let cfg = try_load(&base())?;
@@ -196,6 +205,20 @@ fn config_rejects_invalid_timeout_ladder() {
   assert!(matches!(result, Err(ConfigError::InvalidTimeoutLadder)));
 }
 
+#[test]
+fn config_rejects_access_ttl_longer_than_refresh() {
+  let map = with_ttl(2_592_001, 2_592_000);
+  let result = try_load(&map);
+  assert!(matches!(result, Err(ConfigError::InvalidTtlLadder)));
+}
+
+#[test]
+fn config_accepts_access_ttl_equal_to_refresh() -> Result<(), Box<dyn Error>> {
+  let cfg = try_load(&with_ttl(3_600, 3_600))?;
+  assert_eq!(cfg.ttl.access, Duration::from_secs(3_600));
+  Ok(())
+}
+
 #[test]
 fn config_rejects_reserved_openid_scope() {
   let mut map = base();

src/config/types.rs

@@ -100,6 +100,9 @@ impl TtlConfig {
     {
       return Err(ConfigError::InvalidTtl);
     }
+    if ttl.access > ttl.refresh {
+      return Err(ConfigError::InvalidTtlLadder);
+    }
     Ok(ttl)
   }
 }