End session on provider side when it expires

[klaraf755]

No description provided.

[Copilot]

Pull request overview

Adds a mechanism to proactively end OAuth2 provider-side sessions when local Spring Session records expire, aligning provider logout with session expiration.

Changes:

• Introduces a scheduled job that finds expired Spring Session rows, loads their security context, logs out at the OAuth2 provider, and deletes the session.
• Refactors OAuth2Util.endUserSession to accept a SecurityContext (instead of a Session) and updates call sites/tests accordingly.
• Adjusts test DB/schema initialization and test datasource settings to use a dedicated core schema.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/main/java/com/czertainly/core/messaging/scheduler/SessionExpirationPublisher.java	New scheduled processor for expired sessions + provider-side logout
src/main/java/com/czertainly/core/util/OAuth2Util.java	Changes logout helper to take SecurityContext
src/main/java/com/czertainly/core/service/impl/UserManagementServiceImpl.java	Updates logout call to pass session security context
src/main/java/com/czertainly/core/config/SessionConfig.java	Disables Spring Session cleanup cron (to be replaced by new logic)
src/main/java/com/czertainly/core/tasks/ScheduledLoggingFilter.java	Null-safety for marker list when filtering scheduler logs
src/main/resources/application.yml	Appends currentSchema to datasource URL
src/test/java/com/czertainly/core/tasks/SessionExpirationPublisherTest.java	Adds tests for expired-session processing
src/test/java/com/czertainly/core/security/oauth2/OAuth2UtilTest.java	Updates tests to call new endUserSession(SecurityContext) signature
src/test/java/com/czertainly/core/util/BaseSpringBootTest.java	Adjusts truncation logic to target core schema
src/test/java/com/czertainly/core/config/SecurityConfigTest.java	Updates test wiring/mocks after enabling session auto-config
src/test/java/com/czertainly/core/config/SessionConfig.java	Removes test-only config used to disable JDBC session in tests
src/test/resources/application.yml	Updates test datasource pooling + schema defaults/init behavior
src/test/resources/schema.sql	Ensures core schema exists for tests

Comments suppressed due to low confidence (1)

src/main/java/com/czertainly/core/util/OAuth2Util.java:60

• endUserSession blindly casts securityContext.getAuthentication() to OAuth2AuthenticationToken. With the new call sites (e.g., processing expired sessions / user sessions), this method can be invoked for non-OAuth2 authentications and will throw ClassCastException, preventing session cleanup. Add an instanceof OAuth2AuthenticationToken check (and return/log at debug/warn) before casting.

    public static void endUserSession(SecurityContext securityContext) {
        if (securityContext != null) {
            if (securityContext.getAuthentication() == null) {
                logger.warn("No authentication found in security context. User session cannot be ended.");
                return;
            }
            OAuth2AuthenticationToken authenticationToken = (OAuth2AuthenticationToken) securityContext.getAuthentication();
            AuthenticationSettingsDto authenticationSettingsDto = SettingsCache.getSettings(SettingsSection.AUTHENTICATION);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/main/java/com/czertainly/core/util/OAuth2Util.java:61

• endUserSession unconditionally casts securityContext.getAuthentication() to OAuth2AuthenticationToken, which can throw ClassCastException for non-OAuth2 authentications (or when session data changes). Add an instanceof check and return/log when the authentication is not an OAuth2AuthenticationToken.

    public static void endUserSession(SecurityContext securityContext) {
        if (securityContext != null) {
            if (securityContext.getAuthentication() == null) {
                logger.warn("No authentication found in security context. User session cannot be ended.");
                return;
            }
            OAuth2AuthenticationToken authenticationToken = (OAuth2AuthenticationToken) securityContext.getAuthentication();
            AuthenticationSettingsDto authenticationSettingsDto = SettingsCache.getSettings(SettingsSection.AUTHENTICATION);
            String authorizedClientRegistrationId = authenticationToken.getAuthorizedClientRegistrationId();

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
85.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud