fix(multiplayer): bound workload credential lifetime

server/agones/allocation.go

@@ -38,11 +38,12 @@ type Client struct {
 	// WorkloadTokenTTL bounds how long the minted token remains valid; it
 	// must comfortably exceed the time between allocation and this
 	// GameServer completing process-ready/assignment-ready registration.
-	// Zero defaults to 30 minutes.
+	// Zero defaults to DefaultWorkloadTokenTTL (two hours).
 	WorkloadTokenTTL time.Duration
 }
 
 const DefaultHTTPTimeout = 10 * time.Second
+const DefaultWorkloadTokenTTL = 2 * time.Hour
 
 type AllocatedServer struct {
 	Allocation domain.Allocation
@@ -250,7 +251,7 @@ func (c Client) Allocate(ctx context.Context, request domain.AllocationRequest,
 	if len(c.WorkloadSecret) > 0 {
 		ttl := c.WorkloadTokenTTL
 		if ttl <= 0 {
-			ttl = 30 * time.Minute
+			ttl = DefaultWorkloadTokenTTL
 		}
 		token, err := workload.IssueSignedWorkloadToken(c.WorkloadSecret, request.AllocationID, now, ttl)
 		if err != nil {

server/agones/allocation_test.go

@@ -114,6 +114,12 @@ func TestAllocateRequestsAWorkloadTokenAnnotationWhenConfigured(t *testing.T) {
 	if claims.AllocationID != "allocation-1" {
 		t.Fatalf("token names allocation %q, want %q", claims.AllocationID, "allocation-1")
 	}
+	if _, err := workload.ParseSignedWorkloadToken(secret, token, now.Add(DefaultWorkloadTokenTTL-time.Second)); err != nil {
+		t.Fatalf("default token expired before its documented lifetime: %v", err)
+	}
+	if _, err := workload.ParseSignedWorkloadToken(secret, token, now.Add(DefaultWorkloadTokenTTL)); err == nil {
+		t.Fatal("default token remained valid at its exact expiry boundary")
+	}
 
 	gotAnnotations = nil
 	unsigned := Client{BaseURL: server.URL, Namespace: "games", HTTP: server.Client()}