Name type used for Authentication TTL

src/auth/User.cc

@@ -256,7 +256,7 @@ Auth::User::CredentialsCacheStats(StoreEntry *output)
                           Auth::Type_str[auth_user->auth_type],
                           CredentialState_str[auth_user->credentials()],
                           auth_user->ttl(),
-                          static_cast<int32_t>(auth_user->expiretime - squid_curtime + Auth::TheConfig.credentialsTtl),
+                          static_cast<Auth::Ttl>(auth_user->expiretime - squid_curtime + Auth::TheConfig.credentialsTtl),
                           auth_user->username(),
                           SQUIDSBUFPRINT(auth_user->userKey())
                          );

src/auth/User.h

@@ -66,10 +66,15 @@ class User : public RefCountable
     const SBuf userKey() const {return userKey_;}
 
     /**
-     * How long these credentials are still valid for.
-     * Negative numbers means already expired.
+     * Credentials are not permitted to be re-used from a
+     * credentials cache unless the authentication scheme
+     * defines a way to determine a TTL with which to bound
+     * the scope of their valid re-use.
+     *
+     * \returns How long these credentials are still valid for.
+     *          Negative numbers means already expired.
      */
-    virtual int32_t ttl() const = 0;
+    virtual Ttl ttl() const { return -1; }
 
     /* Manage list of IPs using this username */
     void clearIp();

src/auth/basic/User.cc

@@ -25,14 +25,14 @@ Auth::Basic::User::~User()
     safe_free(passwd);
 }
 
-int32_t
+Auth::Ttl
 Auth::Basic::User::ttl() const
 {
     if (credentials() != Auth::Ok && credentials() != Auth::Pending)
-        return -1; // TTL is obsolete NOW.
+        return Auth::User::ttl(); // TTL is obsolete NOW.
 
-    int32_t basic_ttl = expiretime - squid_curtime + static_cast<Auth::Basic::Config*>(config)->credentialsTTL;
-    int32_t global_ttl = static_cast<int32_t>(expiretime - squid_curtime + Auth::TheConfig.credentialsTtl);
+    const Ttl basic_ttl = expiretime - squid_curtime + static_cast<Auth::Basic::Config*>(config)->credentialsTTL;
+    const auto global_ttl = static_cast<Ttl>(expiretime - squid_curtime + Auth::TheConfig.credentialsTtl);
 
     return min(basic_ttl, global_ttl);
 }

src/auth/basic/User.h

@@ -36,9 +36,9 @@ class User : public Auth::User
 
     /** Update the cached password for a username. */
     void updateCached(User *from);
-    int32_t ttl() const override;
 
     /* Auth::User API */
+    Ttl ttl() const override;
     static CbcPointer<Auth::CredentialsCache> Cache();
     void addToNameCache() override;
 

src/auth/digest/User.cc

@@ -36,13 +36,11 @@ Auth::Digest::User::~User()
     }
 }
 
-int32_t
+Auth::Ttl
 Auth::Digest::User::ttl() const
 {
-    int32_t global_ttl = static_cast<int32_t>(expiretime - squid_curtime + Auth::TheConfig.credentialsTtl);
-
     /* find the longest lasting nonce. */
-    int32_t latest_nonce = -1;
+    Ttl latest_nonce = -1;
     dlink_node *link = nonces.head;
     while (link) {
         digest_nonce_h *nonce = static_cast<digest_nonce_h *>(link->data);
@@ -52,9 +50,10 @@ Auth::Digest::User::ttl() const
         link = link->next;
     }
     if (latest_nonce == -1)
-        return min(-1, global_ttl);
+        return Auth::User::ttl();
 
-    int32_t nonce_ttl = latest_nonce - current_time.tv_sec + static_cast<Config*>(Auth::SchemeConfig::Find("digest"))->noncemaxduration;
+    const auto global_ttl = static_cast<Ttl>(expiretime - squid_curtime + Auth::TheConfig.credentialsTtl);
+    const Ttl nonce_ttl = latest_nonce - current_time.tv_sec + static_cast<Config*>(Auth::SchemeConfig::Find("digest"))->noncemaxduration;
 
     return min(nonce_ttl, global_ttl);
 }

src/auth/digest/User.h

@@ -28,9 +28,9 @@ class User : public Auth::User
 public:
     User(Auth::SchemeConfig *, const char *requestRealm);
     ~User() override;
-    int32_t ttl() const override;
 
     /* Auth::User API */
+    Ttl ttl() const override;
     static CbcPointer<Auth::CredentialsCache> Cache();
     void addToNameCache() override;
 

src/auth/forward.h

@@ -25,6 +25,8 @@ typedef std::vector<Auth::SchemeConfig *> ConfigVector;
 
 class UserRequest;
 
+using Ttl = int32_t;
+
 } // namespace Auth
 
 #endif /* USE_AUTH */

src/auth/negotiate/User.cc

@@ -22,12 +22,6 @@ Auth::Negotiate::User::~User()
     debugs(29, 5, "doing nothing to clear Negotiate scheme data for '" << this << "'");
 }
 
-int32_t
-Auth::Negotiate::User::ttl() const
-{
-    return -1; // Negotiate cannot be cached.
-}
-
 CbcPointer<Auth::CredentialsCache>
 Auth::Negotiate::User::Cache()
 {

src/auth/negotiate/User.h

@@ -29,7 +29,6 @@ class User : public Auth::User
 public:
     User(Auth::SchemeConfig *, const char *requestRealm);
     ~User() override;
-    int32_t ttl() const override;
 
     /* Auth::User API */
     static CbcPointer<Auth::CredentialsCache> Cache();

src/auth/ntlm/User.cc

@@ -22,12 +22,6 @@ Auth::Ntlm::User::~User()
     debugs(29, 5, "doing nothing to clear NTLM scheme data for '" << this << "'");
 }
 
-int32_t
-Auth::Ntlm::User::ttl() const
-{
-    return -1; // NTLM credentials cannot be cached.
-}
-
 CbcPointer<Auth::CredentialsCache>
 Auth::Ntlm::User::Cache()
 {

src/auth/ntlm/User.h

@@ -27,7 +27,6 @@ class User : public Auth::User
 public:
     User(Auth::SchemeConfig *, const char *requestRealm);
     ~User() override;
-    int32_t ttl() const override;
 
     /* Auth::User API */
     static CbcPointer<Auth::CredentialsCache> Cache();