KubeStorage annotates every Secret with garbage-collect-after timestamp

Signed-off-by: Margo Crawford <margaretc@vmware.com>

internal/oidc/kube_storage.go

@@ -32,12 +32,13 @@ type KubeStorage struct {
 }
 
 func NewKubeStorage(secrets corev1client.SecretInterface, timeoutsConfiguration TimeoutsConfiguration) *KubeStorage {
+	nowFunc := time.Now
 	return &KubeStorage{
-		authorizationCodeStorage: authorizationcode.New(secrets, time.Now, timeoutsConfiguration.AuthorizationCodeSessionStorageLifetime),
-		pkceStorage:              pkce.New(secrets),
-		oidcStorage:              openidconnect.New(secrets),
-		accessTokenStorage:       accesstoken.New(secrets),
-		refreshTokenStorage:      refreshtoken.New(secrets),
+		authorizationCodeStorage: authorizationcode.New(secrets, nowFunc, timeoutsConfiguration.AuthorizationCodeSessionStorageLifetime),
+		pkceStorage:              pkce.New(secrets, nowFunc, timeoutsConfiguration.PKCESessionStorageLifetime),
+		oidcStorage:              openidconnect.New(secrets, nowFunc, timeoutsConfiguration.OIDCSessionStorageLifetime),
+		accessTokenStorage:       accesstoken.New(secrets, nowFunc, timeoutsConfiguration.AccessTokenSessionStorageLifetime),
+		refreshTokenStorage:      refreshtoken.New(secrets, nowFunc, timeoutsConfiguration.RefreshTokenSessionStorageLifetime),
 	}
 }
 

internal/oidc/token/token_handler_test.go

@@ -495,29 +495,6 @@ func TestTokenEndpoint(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "auth code is invalidated",
-			authcodeExchange: authcodeExchangeInputs{
-				modifyStorage: func(
-					t *testing.T,
-					s interface {
-						oauth2.TokenRevocationStorage
-						oauth2.CoreStorage
-						openid.OpenIDConnectRequestStorage
-						pkce.PKCERequestStorage
-						fosite.ClientManager
-					},
-					authCode string,
-				) {
-					err := s.InvalidateAuthorizeCodeSession(context.Background(), getFositeDataSignature(t, authCode))
-					require.NoError(t, err)
-				},
-				want: tokenEndpointResponseExpectedValues{
-					wantStatus:            http.StatusBadRequest,
-					wantErrorResponseBody: fositeReusedAuthCodeErrorBody,
-				},
-			},
-		},
 		{
 			name: "redirect uri is missing in request",
 			authcodeExchange: authcodeExchangeInputs{