do not check session_expires_at for guest users that do not login l…

…ocally

CHANGES.md

@@ -1,5 +1,8 @@
 # Changelog
 
+## 2.2.1 (2020-05-06)
+- do not check `session_expires_at` for guest users that do not login locally
+
 ## 2.2.0 (2020-05-03)
 - better logging in case permissions for connecting to VPN are not available
 - log user login with updated permissions/expiry times

src/Api/ConnectionsModule.php

@@ -132,13 +132,21 @@ private function verifyConnection($profileId, $commonName)
 
         $userId = $result['user_id'];
 
-        // this is always string, but DB gives back scalar|null
-        $sessionExpiresAt = new DateTime((string) $this->storage->getSessionExpiresAt($userId));
-        if ($sessionExpiresAt->getTimestamp() < $this->dateTime->getTimestamp()) {
-            $errMsg = sprintf('[VPN] the certificate is still valid, but the session expired at %s', $sessionExpiresAt->format(DateTime::ATOM));
-            $this->storage->addUserMessage($userId, 'notification', $errMsg);
-
-            return new ApiErrorResponse('connect', $errMsg);
+        if (false === strpos($userId, '!!')) {
+            // FIXME "!!" indicates it is a remote guest user coming in with a
+            // foreign OAuth token, for those we do NOT check expiry.. this is
+            // really ugly hack, we need to get rid of sessionExpiresAt
+            // completely instead! This check is skipped when a non remote
+            // guest user id contains '!!' for some reason...
+            //
+            // this is always string, but DB gives back scalar|null
+            $sessionExpiresAt = new DateTime((string) $this->storage->getSessionExpiresAt($userId));
+            if ($sessionExpiresAt->getTimestamp() < $this->dateTime->getTimestamp()) {
+                $errMsg = sprintf('[VPN] the certificate is still valid, but the session expired at %s', $sessionExpiresAt->format(DateTime::ATOM));
+                $this->storage->addUserMessage($userId, 'notification', $errMsg);
+
+                return new ApiErrorResponse('connect', $errMsg);
+            }
         }
 
         if ($result['user_is_disabled']) {