Role-Based Token Lifetime Configuration with Expr Expressions

Summary

This PR implements role-based token lifetime configuration using expr expressions, providing administrators with flexible control over API token lifetimes based on user attributes and roles.

The implementation allows administrators to configure custom expr expressions that evaluate user roles, organization membership, email domains, and other attributes to determine appropriate token lifetimes dynamically.

Key Features

• Expr Expression Support: Configure token lifetimes using powerful expr expressions with access to user subject data
• Role-Based Logic: Support for both site-wide roles (e.g., "owner", "member") and organization-specific roles
• Flexible Evaluation: Access tosubject.Roles,subject.Email,subject.Groups,globalMaxDuration, anddefaultDuration variables
• Backward Compatibility: Falls back to global maximum when no expression is configured
• Graceful Error Handling: Falls back to default duration on expression evaluation errors
• Comprehensive Testing: Full test coverage including integration tests and edge cases

Configuration

The new--max-token-lifetime-expression flag accepts expr expressions that return duration values:

coder server --max-token-lifetime-expression='any(subject.Roles, .Name == "owner") ? duration("168h") : duration("24h")'

(Can also be set via an env variable or YAML.)

Example Expressions

Role-based configuration:

any(subject.Roles, .Name == "owner") ? duration("720h") :any(subject.Roles, .Name == "user-admin") ? duration("168h") : duration("24h")

Organization-specific roles:

any(subject.Roles, .Name == "organization-admin" && .OrgID != "") ? duration("168h") :any(subject.Roles, .Name == "organization-member" && .OrgID != "") ? duration("72h") :duration(defaultDuration)

Email domain-based:

subject.Email endsWith "@company.com" ? duration("720h") : duration("24h")

Implementation Details

• Expr Environment: Custom expr environment with native type support for Subject and Role structs
• Duration Function: Built-in duration() function for parsing duration strings
• Expression Compilation: Expressions are compiled once at server startup for performance
• Error Handling: Graceful fallback to default duration on evaluation errors with logging
• Security: Input validation and type checking for all expr expressions
• Type Safety: Uses int64 representation for durations to work with expr's type system

Behavior

• Startup: Expressions are compiled during server startup; invalid expressions prevent server start
• Evaluation: For each token creation, the expression is evaluated with the user's current attributes
• Fallback: On evaluation errors, the system falls back to the default token duration and logs the error
• Precedence: When configured, the expression result takes precedence over the global maximum token lifetime

Future Enhancements

The following improvements are planned for future PRs:

• Expression evaluation timeout protection
• Expression complexity limits
• Hot-reloading of expressions without server restart

Breaking Changes

None - this is a purely additive feature with backward compatibility.

Historical Implementation Notes

Note for reviewers: This PR presents the expr-based approach. An alternative JSON-based configuration was also implemented in commit63eaf5c. We chose the expr approach for its flexibility in supporting complex logic, email domains, and other advanced use cases while maintaining simplicity for basic scenarios.

Previous Description:

Fixes#17395

Graphite generated description:

Role-Based Token Lifetime Configuration

This PR adds support for role-based token lifetime configuration, enabling administrators to set distinct maximum API token lifetimes for various user roles.

Key features:

• Added a new --role-token-lifetimes configuration option that accepts a JSON mapping of roles to maximum token lifetimes
• Supports both site-wide roles (e.g., "owner", "member") and organization-specific roles (e.g., "MyOrg/admin")
• Automatically resolves organization names to IDs during server startup
• Uses the most generous lifetime a user is entitled to based on their roles
• Maintains backward compatibility with the global maximum token lifetime setting

The configuration uses Go duration format (e.g., "720h" for 30 days) and can be set via CLI flag, environment variable, or YAML configuration. When a user creates a token, the system checks their roles and applies the appropriate maximum lifetime.

Example configuration:

{"owner":"720h","user-admin":"168h","MyOrg/template-admin":"72h"}

This implementation includes comprehensive test coverage for various scenarios, including validation, parsing, and integration with the token creation workflow.