loopback logout fail if ttl >= -1

[josephlaw]

"node_modules/loopback/common/models/access-token.js"

  assert(this.ttl !== 0, 'token.ttl must be not be 0');
  assert(this.ttl, 'token.ttl must exist');
  assert(this.ttl >= -1, 'token.ttl must be >= -1');

  var now = Date.now();
  var created = this.created.getTime();
  var elapsedSeconds = (now - created) / 1000;
  var secondsToLive = this.ttl;
  var isValid = elapsedSeconds < secondsToLive; <======= already false

[richardpringle]

Hey @josephlaw, I'm not quite sure I understand the context here. How can I reproduce this?

By default, ttl is 1209600 (which is obviously greater than -1) and you can login and logout no problem...

[josephlaw]

In client side, I call the login with { email:xxxx, password:yyyy, ttl:-1 } .

So that i added below code into LB access-token.js
var isValid = elapsedSeconds < secondsToLive;
if (this.ttl >= -1) { isValid = true;} <===== add by @josephlaw

[richardpringle]

@josephlaw, are you expecting ttl = -1 to be unlimited?

After taking a deeper dive into our code, it appears as though -1 is a valid ttl value that invalidates the access-token. I believe this is actually by design.

@bajtos will have to confirm.

[josephlaw]

yes, I expect it will not expire.

[richardpringle]

@josephlaw

There is a pull request for the desired feature: #1797

I am closing this issue since the problem has already been addressed in the PR, please leave any further comments on there.