[I] Child AuthSession inherits parent's expiresAtMillis, causing incorrect token refresh scheduling [iceberg]

["bharos (via GitHub)" <gi...@apache.org>]

bharos opened a new issue, #16002:
URL: https://github.com/apache/iceberg/issues/16002

   ### Apache Iceberg version
   
   1.10.1 (latest release)
   
   ### Query engine
   
   Trino
   
   ### Please describe the bug 🐞
   
   When creating a child AuthSession via fromTokenResponse() or fromAccessToken(), the AuthConfig builder uses .from(parent.config()) to inherit configuration. Immutables' from() copies all explicitly set values from the parent config — including expiresAtMillis. This overrides the @Value.Default on expiresAtMillis() that would otherwise recompute from the child's own JWT exp claim.
   
   As a result, the child session's first token refresh is scheduled based on the parent's token expiry, not its own.
   
   Impact
   In token exchange flows where a catalog session holds a long-lived token (e.g., 1-hour IdP token) and the exchanged per-user token is short-lived (e.g., 5 minutes), the refresh is scheduled ~54 minutes out instead of ~4.5 minutes. The short-lived token expires without being refreshed, causing 401 Unauthorized errors on subsequent requests.
   
   
   Root Cause
   ```
   AuthConfig.builder()
       .from(parent.config())   // copies parent's expiresAtMillis
       .token(response.token()) // sets new token, but expiresAtMillis already set
       .tokenType(issuedTokenType)
       .credential(credential)
       .build()
   ```
   The @Value.Default on expiresAtMillis() calls OAuth2Util.expiresAtMillis(token()) to parse the JWT exp claim. But because from() has already copied the parent's explicit expiresAtMillis value, Immutables treats it as explicitly set and skips the default computation.
   
   ### Willingness to contribute
   
   - [x] I can contribute a fix for this bug independently
   - [ ] I would be willing to contribute a fix for this bug with guidance from the Iceberg community
   - [ ] I cannot contribute a fix for this bug at this time


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org

Re: [I] Child AuthSession inherits parent's expiresAtMillis, causing incorrect token refresh scheduling [iceberg]

["singhpk234 (via GitHub)" <gi...@apache.org>]

singhpk234 closed issue #16002: Child AuthSession inherits parent's expiresAtMillis, causing incorrect token refresh scheduling
URL: https://github.com/apache/iceberg/issues/16002


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org