auth: Rename `timestampThreshold` to `tokenValidityDuration`

The `timestampThreshold` records how long a token is going to stay valid
for authentication purposes. It's not quite obvious going by its name,
so let's rename it to `tokenValidityDuration` to hopefullymake its
purpose a bit more obvious.

1 files changed, 11 insertions, 10 deletions

diff --git a/auth/token.go b/auth/token.go
index 12c11740c..1c715a3d0 100644
--- a/auth/token.go
+++ b/auth/token.go
@@ -16,10 +16,10 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-var timestampThresholdDuration time.Duration
+var tokenValidityDuration time.Duration
 
 var (
-	timestampThreshold = "30s"
+	tokenValidity = "30s"
 	errUnauthenticated = status.Errorf(codes.Unauthenticated, "authentication required")
 	errDenied          = status.Errorf(codes.PermissionDenied, "permission denied")
 
@@ -32,16 +32,17 @@ var (
 	)
 )
 
-// TimestampThreshold is used by tests
-func TimestampThreshold() time.Duration {
-	return timestampThresholdDuration
+// TokenValidityDuration returns the duration for which any token will be
+// valid. This is currently only used by our testing infrastructure.
+func TokenValidityDuration() time.Duration {
+	return tokenValidityDuration
 }
 
 func init() {
 	prometheus.MustRegister(authErrors)
 
 	var err error
-	timestampThresholdDuration, err = time.ParseDuration(timestampThreshold)
+	tokenValidityDuration, err = time.ParseDuration(tokenValidity)
 	if err != nil {
 		panic(err)
 	}
@@ -68,7 +69,7 @@ func CheckToken(ctx context.Context, secret string, targetTime time.Time) error
 	}
 
 	if authInfo.Version == "v2" {
-		if v2HmacInfoValid(authInfo.Message, authInfo.SignedMessage, []byte(secret), targetTime, timestampThresholdDuration) {
+		if v2HmacInfoValid(authInfo.Message, authInfo.SignedMessage, []byte(secret), targetTime, tokenValidityDuration) {
 			return nil
 		}
 	}
@@ -101,7 +102,7 @@ func ExtractAuthInfo(ctx context.Context) (*AuthInfo, error) {
 
 func countV2Error(message string) { authErrors.WithLabelValues("v2", message).Inc() }
 
-func v2HmacInfoValid(message string, signedMessage, secret []byte, targetTime time.Time, timestampThreshold time.Duration) bool {
+func v2HmacInfoValid(message string, signedMessage, secret []byte, targetTime time.Time, tokenValidity time.Duration) bool {
 	expectedHMAC := hmacSign(secret, message)
 	if !hmac.Equal(signedMessage, expectedHMAC) {
 		countV2Error("wrong hmac signature")
@@ -115,8 +116,8 @@ func v2HmacInfoValid(message string, signedMessage, secret []byte, targetTime ti
 	}
 
 	issuedAt := time.Unix(timestamp, 0)
-	lowerBound := targetTime.Add(-timestampThreshold)
-	upperBound := targetTime.Add(timestampThreshold)
+	lowerBound := targetTime.Add(-tokenValidity)
+	upperBound := targetTime.Add(tokenValidity)
 
 	if issuedAt.Before(lowerBound) {
 		countV2Error("timestamp too old")