feat: make auth token staleness and duration configurable (#777)

* feat: make auth token time to live and staleness configurable

* docs: add configuration docs for auth token TTL and staleness

Co-authored-by: Jeff Mitchell <jeffrey.mitchell@gmail.com>

internal/cmd/config/config.go

@@ -11,10 +11,12 @@ import (
 	"net/url"
 	"os"
 	"strings"
+	"time"
 
 	wrapping "github.com/hashicorp/go-kms-wrapping"
 	"github.com/hashicorp/hcl"
 	"github.com/hashicorp/shared-secure-libs/configutil"
+	"github.com/hashicorp/vault/sdk/helper/parseutil"
 )
 
 const (
@@ -99,6 +101,15 @@ type Controller struct {
 	Description       string    `hcl:"description"`
 	Database          *Database `hcl:"database"`
 	PublicClusterAddr string    `hcl:"public_cluster_addr"`
+
+	// AuthTokenTimeToLive is the total valid lifetime of a token denoted by time.Duration
+	AuthTokenTimeToLive         interface{} `hcl:"auth_token_time_to_live"`
+	AuthTokenTimeToLiveDuration time.Duration
+
+	// AuthTokenTimeToStale is the total time a token can go unused before becoming invalid
+	// denoted by time.Duration
+	AuthTokenTimeToStale         interface{} `hcl:"auth_token_time_to_stale"`
+	AuthTokenTimeToStaleDuration time.Duration
 }
 
 type Worker struct {
@@ -211,6 +222,25 @@ func Parse(d string) (*Config, error) {
 		return nil, err
 	}
 
+	// Perform controller configuration overrides for auth token settings
+	if result.Controller != nil {
+		if result.Controller.AuthTokenTimeToLive != "" {
+			t, err := parseutil.ParseDurationSecond(result.Controller.AuthTokenTimeToLive)
+			if err != nil {
+				return result, err
+			}
+			result.Controller.AuthTokenTimeToLiveDuration = t
+		}
+
+		if result.Controller.AuthTokenTimeToStale != "" {
+			t, err := parseutil.ParseDurationSecond(result.Controller.AuthTokenTimeToStale)
+			if err != nil {
+				return result, err
+			}
+			result.Controller.AuthTokenTimeToStaleDuration = t
+		}
+	}
+
 	sharedConfig, err := configutil.ParseConfig(d)
 	if err != nil {
 		return nil, err