From 1d3ebbee0fa1476ddd3cf67ed67f53b9264adf0d Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Fri, 19 Feb 2021 13:41:29 +0100
Subject: [PATCH 01/10] feat: implement useCredentials

---
 src/core/jwt/jwtTokenHandler.js | 64 ++++++++++++++++++++++-----------
 1 file changed, 44 insertions(+), 20 deletions(-)

diff --git a/src/core/jwt/jwtTokenHandler.js b/src/core/jwt/jwtTokenHandler.js
index 2d59d0b..b7c0841 100644
--- a/src/core/jwt/jwtTokenHandler.js
+++ b/src/core/jwt/jwtTokenHandler.js
@@ -13,7 +13,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  *
- * Copyright (c) 2019 (original work) Open Assessment Technologies SA ;
+ * Copyright (c) 2019-2021 (original work) Open Assessment Technologies SA ;
  */
 
 /**
@@ -32,10 +32,14 @@ import promiseQueue from 'core/promiseQueue';
  * @param {Object} options Options of JWT token handler
  * @param {String} options.serviceName Name of the service what JWT token belongs to
  * @param {String} options.refreshTokenUrl Url where handler could refresh JWT token
+ * @param {Boolean} [options.useCredentials] refreshToken stored in cookie instead of store
  * @returns {Object} JWT Token handler instance
  */
-const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({serviceName = 'tao', refreshTokenUrl} = {}) {
-
+const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({
+    serviceName = 'tao',
+    refreshTokenUrl,
+    useCredentials = false
+} = {}) {
     const tokenStorage = jwtTokenStoreFactory({
         namespace: serviceName
     });
@@ -51,29 +55,42 @@ const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({serviceName = 't
      * It will refresh the token from provided API and saves it for later use
      * @returns {Promise<String>} Promise of new token
      */
-    const unQueuedRefreshToken = () => tokenStorage.getRefreshToken().then(refreshToken => {
-        if (!refreshToken) {
-            throw new Error('Refresh token is not available');
+    const unQueuedRefreshToken = () => {
+        let body;
+        let credentials;
+        let flow;
+
+        if (useCredentials) {
+            credentials = 'include';
+            flow = Promise.resolve();
         } else {
-            return fetch(refreshTokenUrl, {
+            flow = tokenStorage.getRefreshToken().then(refreshToken => {
+                if (!refreshToken) {
+                    throw new Error('Refresh token is not available');
+                } else {
+                    body = JSON.stringify({ refreshToken });
+                }
+            });
+        }
+
+        return flow.then(() => fetch(refreshTokenUrl, {
                 method: 'POST',
+                credentials,
                 headers: {
                     'Content-Type': 'application/json'
                 },
-                body: JSON.stringify({ refreshToken })
+                body
+        }))
+            .then(response => {
+                if (response.status === 200) {
+                    return response.json();
+                }
+                const error = new Error('Unsuccessful token refresh');
+                error.response = response;
+                return Promise.reject(error);
             })
-                .then(response => {
-                    if (response.status === 200) {
-                        return response.json();
-                    }
-                    const error = new Error('Unsuccessful token refresh');
-                    error.response = response;
-                    return Promise.reject(error);
-                })
-                .then(({ accessToken }) => tokenStorage.setAccessToken(accessToken).then(() => accessToken));
-
-        }
-    });
+            .then(({ accessToken }) => tokenStorage.setAccessToken(accessToken).then(() => accessToken));
+    };
 
     return {
         /**
@@ -90,6 +107,10 @@ const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({serviceName = 't
                 if (accessToken) {
                     return accessToken;
                 }
+
+                if (useCredentials) {
+                    return unQueuedRefreshToken();
+                }
                 return tokenStorage.getRefreshToken().then(refreshToken => {
                     if (refreshToken) {
                         return unQueuedRefreshToken();
@@ -106,6 +127,9 @@ const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({serviceName = 't
          * @returns {Promise<Boolean>} Promise of token is stored
          */
         storeRefreshToken(refreshToken) {
+            if (useCredentials) {
+                return Promise.resolve(false);
+            }
             return actionQueue.serie(() => tokenStorage.setRefreshToken(refreshToken));
         },
 

From b653d8574eb074c3b3e6d13bbe67051ea234e14a Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Fri, 19 Feb 2021 14:17:31 +0100
Subject: [PATCH 02/10] test: useCredential case

---
 test/core/jwt/jwtTokenHandler/test.js | 45 +++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/test/core/jwt/jwtTokenHandler/test.js b/test/core/jwt/jwtTokenHandler/test.js
index 5e3f3cf..5e800c6 100644
--- a/test/core/jwt/jwtTokenHandler/test.js
+++ b/test/core/jwt/jwtTokenHandler/test.js
@@ -304,4 +304,49 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
             Promise.all([refreshTokenPromise1, refreshTokenPromise2]).then(done);
         });
     });
+
+    QUnit.module('useCredential', {
+        beforeEach: function() {
+            this.handler = jwtTokenHandlerFactory({ refreshTokenUrl: '/refreshUrl', useCredentials: true });
+        },
+        afterEach: function(assert) {
+            const done = assert.async();
+            fetchMock.restore();
+            this.handler.clearStore().then(done);
+        }
+    });
+
+    QUnit.test('refresh token', function(assert) {
+        assert.expect(4);
+
+        const done = assert.async();
+
+        const accessToken = 'some access token';
+
+        fetchMock.mock('/refreshUrl', function(url, opts) {
+            assert.equal(opts.credentials, 'include', 'credentials are sent to the api');
+            assert.equal(typeof opts.body, 'undefined', 'body is undefined');
+            return JSON.stringify({ accessToken });
+        });
+
+        this.handler.getToken().then(refreshedAccessToken => {
+            assert.equal(refreshedAccessToken, accessToken, 'get refreshed access token');
+
+            this.handler.getToken().then(storedAccessToken => {
+                assert.equal(storedAccessToken, accessToken, 'get access token from store without refresh');
+                done();
+            });
+        });
+    });
+
+    QUnit.test('cannot set refresh token', function(assert) {
+        assert.expect(1);
+
+        const done = assert.async();
+
+        this.handler.storeRefreshToken('refreshToken').then(setTokenResult => {
+            assert.equal(setTokenResult, false, 'refresh token is not set');
+            done();
+        });
+    });
 });

From 1a97b29696d1de37838a20879449edf0220dee32 Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Fri, 19 Feb 2021 14:18:37 +0100
Subject: [PATCH 03/10] chore: update license header

---
 test/core/jwt/jwtTokenHandler/test.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/core/jwt/jwtTokenHandler/test.js b/test/core/jwt/jwtTokenHandler/test.js
index 5e800c6..1a02a53 100644
--- a/test/core/jwt/jwtTokenHandler/test.js
+++ b/test/core/jwt/jwtTokenHandler/test.js
@@ -13,7 +13,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  *
- * Copyright (c) 2019 (original work) Open Assessment Technologies SA ;
+ * Copyright (c) 2019-2021 (original work) Open Assessment Technologies SA ;
  */
 
 /**

From 16948bcf634a4fc0d849b3b04e0d55702677371e Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Mon, 22 Feb 2021 09:52:25 +0100
Subject: [PATCH 04/10] feat: support acessTokenTTL in jwtTokenStore

---
 src/core/jwt/jwtTokenStore.js | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/core/jwt/jwtTokenStore.js b/src/core/jwt/jwtTokenStore.js
index 1191103..5088b7b 100644
--- a/src/core/jwt/jwtTokenStore.js
+++ b/src/core/jwt/jwtTokenStore.js
@@ -13,7 +13,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  *
- * Copyright (c) 2019 (original work) Open Assessment Technologies SA ;
+ * Copyright (c) 2019-2021 (original work) Open Assessment Technologies SA ;
  */
 
 /**
@@ -27,13 +27,20 @@ import store from 'core/store';
 /**
  * @param {Object} options - Factory options
  * @param {string} options.namespace - Namespace of the store
+ * @param {Number} options.accessTokenTTL - TTL of accessToken in ms
  * @returns {Object} Store API
  */
-const jwtTokenStoreFactory = function jwtTokenStoreFactory({namespace = 'global'} = {}) {
+const jwtTokenStoreFactory = function jwtTokenStoreFactory({
+    namespace = 'global',
+    accessTokenTTL: accessTokenTTLParam
+} = {}) {
     const storeName = `jwt.${namespace}`;
     const accessTokenName = 'accessToken';
     const refreshTokenName = 'refreshToken';
 
+    let accessTokenTTL = accessTokenTTLParam;
+    let accessTokenStoredAt = 0;
+
     /**
      * Do not change token stores, because of security reason.
      */
@@ -48,6 +55,7 @@ const jwtTokenStoreFactory = function jwtTokenStoreFactory({namespace = 'global'
          * @returns {Promise<Boolean>} token successfully set
          */
         setAccessToken(token) {
+            accessTokenStoredAt = Date.now();
             return getAccessTokenStore().then(storage => storage.setItem(accessTokenName, token));
         },
 
@@ -56,6 +64,9 @@ const jwtTokenStoreFactory = function jwtTokenStoreFactory({namespace = 'global'
          * @returns {Promise<string|null>} stored access token
          */
         getAccessToken() {
+            if (accessTokenTTL && accessTokenStoredAt + accessTokenTTL < Date.now()) {
+                return Promise.resolve(null);
+            }
             return getAccessTokenStore().then(storage => storage.getItem(accessTokenName));
         },
 
@@ -108,6 +119,15 @@ const jwtTokenStoreFactory = function jwtTokenStoreFactory({namespace = 'global'
          */
         clear() {
             return Promise.all([this.clearAccessToken(), this.clearRefreshToken()]).then(() => true);
+        },
+
+        /**
+         * Set a new TTL value for accessToken
+         * @param {Number} newAccessTokenTTL - accessToken TTL in ms
+         * @returns {void}
+         */
+        setAccessTokenTTL(newAccessTokenTTL) {
+            accessTokenTTL = newAccessTokenTTL;
         }
     };
 };

From c289631f21edebdfb0de4acad34e3e60773fb902 Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Mon, 22 Feb 2021 10:05:42 +0100
Subject: [PATCH 05/10] test: setAccessTokenTTL in store

---
 test/core/jwt/jwtTokenStore/test.js | 87 +++++++++++++++++++++++------
 1 file changed, 71 insertions(+), 16 deletions(-)

diff --git a/test/core/jwt/jwtTokenStore/test.js b/test/core/jwt/jwtTokenStore/test.js
index 9896211..a4f24f4 100644
--- a/test/core/jwt/jwtTokenStore/test.js
+++ b/test/core/jwt/jwtTokenStore/test.js
@@ -41,10 +41,10 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
     });
 
     QUnit.module('API', {
-        beforeEach: function() {
+        beforeEach: function () {
             this.storage = jwtTokenStoreFactory();
         },
-        afterEach: function(assert) {
+        afterEach: function (assert) {
             const done = assert.async();
             this.storage.clear().then(done);
         }
@@ -52,7 +52,7 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
 
     const exampleTokens = ['foo', 'bar', 'baz'];
 
-    QUnit.cases.init(exampleTokens).test('set access token', function(token, assert) {
+    QUnit.cases.init(exampleTokens).test('set access token', function (token, assert) {
         assert.expect(2);
         const done = assert.async();
 
@@ -65,7 +65,7 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
         });
     });
 
-    QUnit.cases.init(exampleTokens).test('set refresh token', function(token, assert) {
+    QUnit.cases.init(exampleTokens).test('set refresh token', function (token, assert) {
         assert.expect(2);
         const done = assert.async();
 
@@ -78,7 +78,7 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
         });
     });
 
-    QUnit.test('set tokens', function(assert) {
+    QUnit.test('set tokens', function (assert) {
         assert.expect(3);
         const done = assert.async();
 
@@ -97,7 +97,7 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
         });
     });
 
-    QUnit.test('clear access token', function(assert) {
+    QUnit.test('clear access token', function (assert) {
         assert.expect(3);
         const done = assert.async();
 
@@ -113,7 +113,7 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
         });
     });
 
-    QUnit.test('clear refresh token', function(assert) {
+    QUnit.test('clear refresh token', function (assert) {
         assert.expect(3);
         const done = assert.async();
 
@@ -129,7 +129,7 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
         });
     });
 
-    QUnit.test('clear tokens', function(assert) {
+    QUnit.test('clear tokens', function (assert) {
         assert.expect(4);
         const done = assert.async();
 
@@ -148,18 +148,73 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
         });
     });
 
+    QUnit.test('accessTokenTTL in constructor', function (assert) {
+        const done = assert.async();
+        assert.expect(3);
+
+        const accessToken = 'foo';
+
+        const storage = jwtTokenStoreFactory({
+            accessTokenTTL: 500
+        });
+
+        storage
+            .setAccessToken(accessToken)
+            .then(storeResult => {
+                assert.ok(storeResult, 'accessToken is stored');
+                return storage.getAccessToken();
+            })
+            .then(storedAccessToken => {
+                assert.equal(storedAccessToken, accessToken, 'accessToken can be received before ttl');
+                return new Promise(resolve => setTimeout(resolve, 500));
+            })
+            .then(storage.getAccessToken)
+            .then(storedAccessToken => {
+                assert.equal(storedAccessToken, null, 'accessToken cannot be received after ttl');
+                done();
+            });
+    });
+
+    QUnit.test('setAccessTokenTTL', function (assert) {
+        const done = assert.async();
+        assert.expect(3);
+
+        const accessToken = 'foo';
+
+        const storage = jwtTokenStoreFactory({
+            accessTokenTTL: 1000
+        });
+
+        storage
+            .setAccessToken(accessToken)
+            .then(storeResult => {
+                assert.ok(storeResult, 'accessToken is stored');
+                return storage.getAccessToken();
+            })
+            .then(storedAccessToken => {
+                assert.equal(storedAccessToken, accessToken, 'accessToken can be received before ttl');
+                storage.setAccessTokenTTL(100);
+                return new Promise(resolve => setTimeout(resolve, 100));
+            })
+            .then(storage.getAccessToken)
+            .then(storedAccessToken => {
+                assert.equal(storedAccessToken, null, 'accessToken cannot be received after ttl');
+                done();
+            });
+    });
+
     QUnit.module('Same namespace', {
-        beforeEach: function() {
+        beforeEach: function () {
             this.storage1 = jwtTokenStoreFactory({ namespace: 'namespace' });
             this.storage2 = jwtTokenStoreFactory({ namespace: 'namespace' });
         },
-        afterEach: function(assert) {
+        afterEach: function (assert) {
             const done = assert.async();
             Promise.all([this.storage1.clear(), this.storage2.clear()]).then(done);
         }
     });
 
-    QUnit.test('stores could access to same tokens', function(assert) {
+    QUnit.test('stores could access to same tokens', function (assert) {
         assert.expect(3);
         const done = assert.async();
 
@@ -178,7 +233,7 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
         });
     });
 
-    QUnit.test('store will be empty if other store will be cleared', function(assert) {
+    QUnit.test('store will be empty if other store will be cleared', function (assert) {
         assert.expect(4);
         const done = assert.async();
 
@@ -201,17 +256,17 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
     });
 
     QUnit.module('Different namespace', {
-        beforeEach: function() {
+        beforeEach: function () {
             this.storage1 = jwtTokenStoreFactory({ namespace: 'namespace1' });
             this.storage2 = jwtTokenStoreFactory({ namespace: 'namespace2' });
         },
-        afterEach: function(assert) {
+        afterEach: function (assert) {
             const done = assert.async();
             Promise.all([this.storage1.clear(), this.storage2.clear()]).then(done);
         }
     });
 
-    QUnit.test('stores could not access to same tokens', function(assert) {
+    QUnit.test('stores could not access to same tokens', function (assert) {
         assert.expect(6);
         const done = assert.async();
 
@@ -242,7 +297,7 @@ define(['core/jwt/jwtTokenStore'], jwtTokenStoreFactory => {
         });
     });
 
-    QUnit.test('store content will be kept if other store will be cleared', function(assert) {
+    QUnit.test('store content will be kept if other store will be cleared', function (assert) {
         assert.expect(4);
         const done = assert.async();
 

From d537b73867b560596c97c0ff1bda7b1c66065170 Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Mon, 22 Feb 2021 10:06:16 +0100
Subject: [PATCH 06/10] feat: accessTokenTTL support for jwtTokenHandler

---
 src/core/jwt/jwtTokenHandler.js | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/core/jwt/jwtTokenHandler.js b/src/core/jwt/jwtTokenHandler.js
index b7c0841..43a4398 100644
--- a/src/core/jwt/jwtTokenHandler.js
+++ b/src/core/jwt/jwtTokenHandler.js
@@ -38,10 +38,12 @@ import promiseQueue from 'core/promiseQueue';
 const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({
     serviceName = 'tao',
     refreshTokenUrl,
+    accessTokenTTL,
     useCredentials = false
 } = {}) {
     const tokenStorage = jwtTokenStoreFactory({
-        namespace: serviceName
+        namespace: serviceName,
+        accessTokenTTL
     });
 
     /**
@@ -156,6 +158,14 @@ const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({
          */
         refreshToken() {
             return actionQueue.serie(() => unQueuedRefreshToken());
+        },
+
+        /**
+         * Set accessToken TTL
+         * @param {Number} accessTokenTTL - accessToken TTL in ms
+         */
+        setAccessTokenTTL(accessTokenTTL) {
+            tokenStorage.setAccessTokenTTL(accessTokenTTL);
         }
     };
 };

From 038f77137776cfc1a2672057b9bb5ac8533de337 Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Mon, 22 Feb 2021 10:28:35 +0100
Subject: [PATCH 07/10] test: jwtToken ttl support

---
 test/core/jwt/jwtTokenHandler/test.html |  17 ++-
 test/core/jwt/jwtTokenHandler/test.js   | 186 +++++++++++++++++-------
 test/core/jwt/jwtTokenStore/test.js     |   2 +-
 3 files changed, 147 insertions(+), 58 deletions(-)

diff --git a/test/core/jwt/jwtTokenHandler/test.html b/test/core/jwt/jwtTokenHandler/test.html
index 93ac5e3..22ca8be 100644
--- a/test/core/jwt/jwtTokenHandler/test.html
+++ b/test/core/jwt/jwtTokenHandler/test.html
@@ -5,18 +5,24 @@
         <title>Test - JWT Token Handler</title>
         <script type="text/javascript" src="/environment/require.js"></script>
         <script type="text/javascript">
-            require(['/environment/config.js'], function() {
-                require(['qunitEnv'], function() {
+            require(['/environment/config.js'], function () {
+                require(['qunitEnv'], function () {
                     // mock jwt token store
-                    define('core/jwt/jwtTokenStore', () => () => {
+                    define('core/jwt/jwtTokenStore', () => ({ accessTokenTTL: accessTokenTTLParam }) => {
                         let accessToken = null;
                         let refreshToken = null;
+                        let accessTokenTTL = accessTokenTTLParam;
+                        let accessTokenStoredAt = 0;
                         return {
                             setAccessToken(newAccessToken) {
                                 accessToken = newAccessToken;
+                                accessTokenStoredAt = Date.now();
                                 return Promise.resolve(true);
                             },
                             getAccessToken() {
+                                if (accessTokenTTL && accessTokenStoredAt + accessTokenTTL < Date.now()) {
+                                    return Promise.resolve(null);
+                                }
                                 return Promise.resolve(accessToken);
                             },
                             setRefreshToken(newRefreshToken) {
@@ -29,10 +35,13 @@
                             clear() {
                                 accessToken = refreshToken = null;
                                 return Promise.resolve(true);
+                            },
+                            setAccessTokenTTL(newAccessTokenTTL) {
+                                accessTokenTTL = newAccessTokenTTL;
                             }
                         };
                     });
-                    require(['test/core/jwt/jwtTokenHandler/test'], function() {
+                    require(['test/core/jwt/jwtTokenHandler/test'], function () {
                         QUnit.start();
                     });
                 });
diff --git a/test/core/jwt/jwtTokenHandler/test.js b/test/core/jwt/jwtTokenHandler/test.js
index 1a02a53..ec6800f 100644
--- a/test/core/jwt/jwtTokenHandler/test.js
+++ b/test/core/jwt/jwtTokenHandler/test.js
@@ -41,27 +41,27 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
     });
 
     QUnit.module('API', {
-        beforeEach: function() {
+        beforeEach: function () {
             this.handler = jwtTokenHandlerFactory({ refreshTokenUrl: '/refreshUrl' });
         },
-        afterEach: function(assert) {
+        afterEach: function (assert) {
             const done = assert.async();
             fetchMock.restore();
             this.handler.clearStore().then(done);
         }
     });
 
-    QUnit.test('get service name', function(assert) {
+    QUnit.test('get service name', function (assert) {
         assert.expect(2);
 
         // default
         assert.strictEqual(this.handler.serviceName, 'tao', 'default service name is tao');
 
-        const handler = jwtTokenHandlerFactory({serviceName: 'foo'});
+        const handler = jwtTokenHandlerFactory({ serviceName: 'foo' });
         assert.strictEqual(handler.serviceName, 'foo', 'return with the provided service name');
     });
 
-    QUnit.test('get access token', function(assert) {
+    QUnit.test('get access token', function (assert) {
         assert.expect(2);
 
         const done = assert.async();
@@ -78,7 +78,7 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         });
     });
 
-    QUnit.test('clear', function(assert) {
+    QUnit.test('clear', function (assert) {
         assert.expect(4);
 
         const done = assert.async();
@@ -101,7 +101,7 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         });
     });
 
-    QUnit.test('refresh token on empty store', function(assert) {
+    QUnit.test('refresh token on empty store', function (assert) {
         assert.expect(1);
 
         assert.rejects(
@@ -111,7 +111,7 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         );
     });
 
-    QUnit.test('refresh token', function(assert) {
+    QUnit.test('refresh token', function (assert) {
         assert.expect(4);
 
         const done = assert.async();
@@ -119,7 +119,7 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         const accessToken = 'some access token';
         const refreshToken = 'some refresh token';
 
-        fetchMock.mock('/refreshUrl', function(url, opts) {
+        fetchMock.mock('/refreshUrl', function (url, opts) {
             const data = JSON.parse(opts.body);
             assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
             return JSON.stringify({ accessToken });
@@ -138,7 +138,7 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         });
     });
 
-    QUnit.test('unsuccessful refresh token', function(assert) {
+    QUnit.test('unsuccessful refresh token', function (assert) {
         assert.expect(5);
 
         const done = assert.async();
@@ -146,28 +146,29 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         const error = 'some backend error';
         const refreshToken = 'some refresh token';
 
-        fetchMock.mock('/refreshUrl', function(url, opts) {
+        fetchMock.mock('/refreshUrl', function (url, opts) {
             const data = JSON.parse(opts.body);
             assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
-            return new Response(JSON.stringify({error}), { status: 401 });
+            return new Response(JSON.stringify({ error }), { status: 401 });
         });
 
         this.handler.storeRefreshToken(refreshToken).then(setTokenResult => {
             assert.equal(setTokenResult, true, 'refresh token is set');
-            this.handler.refreshToken()
-            .catch(e => {
-                assert.equal(e instanceof Error, true, 'rejects with error');
-                assert.equal(e.response instanceof Response, true, 'passes response');
-                return e.response.json();
-            })
-            .then(errorResponse => {
-                assert.equal(errorResponse.error, error, 'should get back api error message');
-                done();
-            });
+            this.handler
+                .refreshToken()
+                .catch(e => {
+                    assert.equal(e instanceof Error, true, 'rejects with error');
+                    assert.equal(e.response instanceof Response, true, 'passes response');
+                    return e.response.json();
+                })
+                .then(errorResponse => {
+                    assert.equal(errorResponse.error, error, 'should get back api error message');
+                    done();
+                });
         });
     });
 
-    QUnit.test('unsuccessful get token if refresh fails', function(assert) {
+    QUnit.test('unsuccessful get token if refresh fails', function (assert) {
         assert.expect(5);
 
         const done = assert.async();
@@ -175,39 +176,40 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         const error = 'some backend error';
         const refreshToken = 'some refresh token';
 
-        fetchMock.mock('/refreshUrl', function(url, opts) {
+        fetchMock.mock('/refreshUrl', function (url, opts) {
             const data = JSON.parse(opts.body);
             assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
-            return new Response(JSON.stringify({error}), { status: 401 });
+            return new Response(JSON.stringify({ error }), { status: 401 });
         });
 
         this.handler.storeRefreshToken(refreshToken).then(setTokenResult => {
             assert.equal(setTokenResult, true, 'refresh token is set');
-            this.handler.getToken()
-            .catch(e => {
-                assert.equal(e instanceof Error, true, 'rejects with error');
-                assert.equal(e.response instanceof Response, true, 'passes response');
-                return e.response.json();
-            })
-            .then(errorResponse => {
-                assert.equal(errorResponse.error, error, 'should get back api error message');
-                done();
-            });
+            this.handler
+                .getToken()
+                .catch(e => {
+                    assert.equal(e instanceof Error, true, 'rejects with error');
+                    assert.equal(e.response instanceof Response, true, 'passes response');
+                    return e.response.json();
+                })
+                .then(errorResponse => {
+                    assert.equal(errorResponse.error, error, 'should get back api error message');
+                    done();
+                });
         });
     });
 
     QUnit.module('Concurrency', {
-        beforeEach: function() {
+        beforeEach: function () {
             this.handler = jwtTokenHandlerFactory({ refreshTokenUrl: '/refreshUrl' });
         },
-        afterEach: function(assert) {
+        afterEach: function (assert) {
             const done = assert.async();
             fetchMock.restore();
             this.handler.clearStore().then(done);
         }
     });
 
-    QUnit.test('queue get token if other get is in progress', function(assert) {
+    QUnit.test('queue get token if other get is in progress', function (assert) {
         assert.expect(4);
 
         const done = assert.async();
@@ -215,10 +217,10 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         const accessToken = 'some access token';
         const refreshToken = 'some refresh token';
 
-        fetchMock.mock('/refreshUrl', function(url, opts) {
+        fetchMock.mock('/refreshUrl', function (url, opts) {
             const data = JSON.parse(opts.body);
             assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
-            return JSON.stringify({accessToken});
+            return JSON.stringify({ accessToken });
         });
 
         this.handler.storeRefreshToken(refreshToken).then(setTokenResult => {
@@ -236,7 +238,7 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         });
     });
 
-    QUnit.test('queue get token if refresh token is in progress', function(assert) {
+    QUnit.test('queue get token if refresh token is in progress', function (assert) {
         assert.expect(4);
 
         const done = assert.async();
@@ -244,10 +246,10 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         const accessToken = 'some access token';
         const refreshToken = 'some refresh token';
 
-        fetchMock.mock('/refreshUrl', function(url, opts) {
+        fetchMock.mock('/refreshUrl', function (url, opts) {
             const data = JSON.parse(opts.body);
             assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
-            return JSON.stringify({accessToken});
+            return JSON.stringify({ accessToken });
         });
 
         this.handler.storeRefreshToken(refreshToken).then(setTokenResult => {
@@ -265,7 +267,7 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         });
     });
 
-    QUnit.test('queue refresh token if another refresh token is in progress', function(assert) {
+    QUnit.test('queue refresh token if another refresh token is in progress', function (assert) {
         assert.expect(5);
 
         const done = assert.async();
@@ -276,18 +278,18 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
 
         const setupSecondRequest = () => {
             fetchMock.restore();
-            fetchMock.mock('/refreshUrl', function(url, opts) {
+            fetchMock.mock('/refreshUrl', function (url, opts) {
                 const data = JSON.parse(opts.body);
                 assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
-                return JSON.stringify({accessToken: accessToken2});
+                return JSON.stringify({ accessToken: accessToken2 });
             });
         };
 
-        fetchMock.mock('/refreshUrl', function(url, opts) {
+        fetchMock.mock('/refreshUrl', function (url, opts) {
             const data = JSON.parse(opts.body);
             assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
             setupSecondRequest();
-            return JSON.stringify({accessToken: accessToken1});
+            return JSON.stringify({ accessToken: accessToken1 });
         });
 
         this.handler.storeRefreshToken(refreshToken).then(setTokenResult => {
@@ -306,24 +308,24 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
     });
 
     QUnit.module('useCredential', {
-        beforeEach: function() {
+        beforeEach: function () {
             this.handler = jwtTokenHandlerFactory({ refreshTokenUrl: '/refreshUrl', useCredentials: true });
         },
-        afterEach: function(assert) {
+        afterEach: function (assert) {
             const done = assert.async();
             fetchMock.restore();
             this.handler.clearStore().then(done);
         }
     });
 
-    QUnit.test('refresh token', function(assert) {
+    QUnit.test('refresh token', function (assert) {
         assert.expect(4);
 
         const done = assert.async();
 
         const accessToken = 'some access token';
 
-        fetchMock.mock('/refreshUrl', function(url, opts) {
+        fetchMock.mock('/refreshUrl', function (url, opts) {
             assert.equal(opts.credentials, 'include', 'credentials are sent to the api');
             assert.equal(typeof opts.body, 'undefined', 'body is undefined');
             return JSON.stringify({ accessToken });
@@ -339,7 +341,7 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
         });
     });
 
-    QUnit.test('cannot set refresh token', function(assert) {
+    QUnit.test('cannot set refresh token', function (assert) {
         assert.expect(1);
 
         const done = assert.async();
@@ -349,4 +351,82 @@ define(['jquery', 'core/jwt/jwtTokenHandler', 'fetch-mock'], ($, jwtTokenHandler
             done();
         });
     });
+
+    QUnit.module('TTL', {
+        beforeEach: function () {
+            this.handler = jwtTokenHandlerFactory({ refreshTokenUrl: '/refreshUrl', accessTokenTTL: 500 });
+        },
+        afterEach: function (assert) {
+            const done = assert.async();
+            fetchMock.restore();
+            this.handler.clearStore().then(done);
+        }
+    });
+
+    QUnit.test('get accessToken with TTL', function (assert) {
+        assert.expect(4);
+
+        const done = assert.async();
+
+        const accessToken = 'some access token';
+        const refreshToken = 'some refresh token';
+        const refreshedAccessToken = 'some new access token';
+
+        fetchMock.mock('/refreshUrl', function (url, opts) {
+            const data = JSON.parse(opts.body);
+            assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
+            return JSON.stringify({ accessToken: refreshedAccessToken });
+        });
+
+        Promise.all([this.handler.storeRefreshToken(refreshToken), this.handler.storeAccessToken(accessToken)]).then(
+            setTokenResults => {
+                assert.deepEqual(setTokenResults, [true, true], 'tokens are set');
+                this.handler
+                    .getToken()
+                    .then(storedAccessToken => {
+                        assert.equal(storedAccessToken, accessToken, 'get same accessToken before TTL');
+                        return new Promise(resolve => setTimeout(resolve, 500));
+                    })
+                    .then(this.handler.getToken)
+                    .then(storedAccessToken => {
+                        assert.equal(storedAccessToken, refreshedAccessToken, 'token will be refreshed after ttl');
+                        done();
+                    });
+            }
+        );
+    });
+
+    QUnit.test('set accessTokenTTL after initialization of store', function (assert) {
+        assert.expect(4);
+
+        const done = assert.async();
+
+        const accessToken = 'some access token';
+        const refreshToken = 'some refresh token';
+        const refreshedAccessToken = 'some new access token';
+
+        fetchMock.mock('/refreshUrl', function (url, opts) {
+            const data = JSON.parse(opts.body);
+            assert.equal(data.refreshToken, refreshToken, 'refresh token is sent to the api');
+            return JSON.stringify({ accessToken: refreshedAccessToken });
+        });
+
+        Promise.all([this.handler.storeRefreshToken(refreshToken), this.handler.storeAccessToken(accessToken)]).then(
+            setTokenResults => {
+                assert.deepEqual(setTokenResults, [true, true], 'tokens are set');
+                this.handler
+                    .getToken()
+                    .then(storedAccessToken => {
+                        assert.equal(storedAccessToken, accessToken, 'get same accessToken before TTL');
+                        this.handler.setAccessTokenTTL(100);
+                        return new Promise(resolve => setTimeout(resolve, 100));
+                    })
+                    .then(this.handler.getToken)
+                    .then(storedAccessToken => {
+                        assert.equal(storedAccessToken, refreshedAccessToken, 'token will be refreshed after ttl');
+                        done();
+                    });
+            }
+        );
+    });
 });
diff --git a/test/core/jwt/jwtTokenStore/test.js b/test/core/jwt/jwtTokenStore/test.js
index a4f24f4..5ce89d6 100644
--- a/test/core/jwt/jwtTokenStore/test.js
+++ b/test/core/jwt/jwtTokenStore/test.js
@@ -13,7 +13,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  *
- * Copyright (c) 2019 (original work) Open Assessment Technologies SA ;
+ * Copyright (c) 2019-2021 (original work) Open Assessment Technologies SA ;
  */
 
 /**

From a100efa25dce6c0b0d2dc323d1655f87302bfd47 Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Mon, 22 Feb 2021 10:30:39 +0100
Subject: [PATCH 08/10] fix: add missing param description

---
 src/core/jwt/jwtTokenHandler.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/core/jwt/jwtTokenHandler.js b/src/core/jwt/jwtTokenHandler.js
index 43a4398..bbc3047 100644
--- a/src/core/jwt/jwtTokenHandler.js
+++ b/src/core/jwt/jwtTokenHandler.js
@@ -32,6 +32,7 @@ import promiseQueue from 'core/promiseQueue';
  * @param {Object} options Options of JWT token handler
  * @param {String} options.serviceName Name of the service what JWT token belongs to
  * @param {String} options.refreshTokenUrl Url where handler could refresh JWT token
+ * @param {Number} [options.accessTokenTTL] Set accessToken TTL in ms for token store
  * @param {Boolean} [options.useCredentials] refreshToken stored in cookie instead of store
  * @returns {Object} JWT Token handler instance
  */

From 47e0b24be1c1a4ccb2c3b2ad056e19f48f1ca2b1 Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Mon, 22 Feb 2021 15:36:22 +0100
Subject: [PATCH 09/10] refac: remove useless else

---
 src/core/jwt/jwtTokenHandler.js | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/src/core/jwt/jwtTokenHandler.js b/src/core/jwt/jwtTokenHandler.js
index bbc3047..e35639b 100644
--- a/src/core/jwt/jwtTokenHandler.js
+++ b/src/core/jwt/jwtTokenHandler.js
@@ -68,22 +68,24 @@ const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({
             flow = Promise.resolve();
         } else {
             flow = tokenStorage.getRefreshToken().then(refreshToken => {
-                if (!refreshToken) {
+                if (refreshToken) {
                     throw new Error('Refresh token is not available');
-                } else {
-                    body = JSON.stringify({ refreshToken });
                 }
+                body = JSON.stringify({ refreshToken });
             });
         }
 
-        return flow.then(() => fetch(refreshTokenUrl, {
-                method: 'POST',
-                credentials,
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body
-        }))
+        return flow
+            .then(() =>
+                fetch(refreshTokenUrl, {
+                    method: 'POST',
+                    credentials,
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body
+                })
+            )
             .then(response => {
                 if (response.status === 200) {
                     return response.json();

From 17caf28be35602222f153427a6a711a1d69498c4 Mon Sep 17 00:00:00 2001
From: Tamas Besenyei <tamas@besenyei.net>
Date: Tue, 23 Feb 2021 12:24:18 +0100
Subject: [PATCH 10/10] fix: refreshToken condition

---
 src/core/jwt/jwtTokenHandler.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/core/jwt/jwtTokenHandler.js b/src/core/jwt/jwtTokenHandler.js
index e35639b..68db4a6 100644
--- a/src/core/jwt/jwtTokenHandler.js
+++ b/src/core/jwt/jwtTokenHandler.js
@@ -68,7 +68,7 @@ const jwtTokenHandlerFactory = function jwtTokenHandlerFactory({
             flow = Promise.resolve();
         } else {
             flow = tokenStorage.getRefreshToken().then(refreshToken => {
-                if (refreshToken) {
+                if (!refreshToken) {
                     throw new Error('Refresh token is not available');
                 }
                 body = JSON.stringify({ refreshToken });