From 63e7523a6de63c3933a3ff1f9de5dcb0281f7fee Mon Sep 17 00:00:00 2001
From: Alexander Schwartz <aschwart@redhat.com>
Date: Wed, 3 Apr 2024 11:05:02 +0200
Subject: [PATCH] Avoid unnecessary updates to the sessions during refreshes of
 tokens

Closes #28388

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
---
 .../infinispan/AuthenticatedClientSessionAdapter.java  |  4 ++++
 .../models/sessions/infinispan/UserSessionAdapter.java | 10 ++++++++++
 .../PersistentAuthenticatedClientSessionAdapter.java   |  3 +++
 .../models/session/PersistentUserSessionAdapter.java   |  3 +++
 .../models/AuthenticatedClientSessionModel.java        |  5 +++++
 .../java/org/keycloak/models/UserSessionModel.java     |  4 ++++
 6 files changed, 29 insertions(+)

diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java
index cf44e6b244..5b7197bbcf 100644
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/AuthenticatedClientSessionAdapter.java
@@ -136,6 +136,10 @@ public class AuthenticatedClientSessionAdapter implements AuthenticatedClientSes
 
     @Override
     public void setTimestamp(int timestamp) {
+        if (timestamp <= getTimestamp()) {
+            return;
+        }
+
         ClientSessionUpdateTask task = new ClientSessionUpdateTask() {
 
             @Override
diff --git a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java
index 146873952d..bccbf98df5 100755
--- a/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java
+++ b/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/UserSessionAdapter.java
@@ -158,6 +158,7 @@ public class UserSessionAdapter<T extends SessionRefreshStore & UserSessionProvi
         clientSessionUuids.forEach(clientSessionId -> this.clientSessionUpdateTx.addTask(clientSessionId, Tasks.removeSync()));
     }
 
+    @Override
     public String getId() {
         return entity.getId();
     }
@@ -177,6 +178,7 @@ public class UserSessionAdapter<T extends SessionRefreshStore & UserSessionProvi
         return entity.getBrokerUserId();
     }
 
+    @Override
     public UserModel getUser() {
         return this.user;
     }
@@ -192,6 +194,7 @@ public class UserSessionAdapter<T extends SessionRefreshStore & UserSessionProvi
         }
     }
 
+    @Override
     public String getIpAddress() {
         return entity.getIpAddress();
     }
@@ -206,15 +209,22 @@ public class UserSessionAdapter<T extends SessionRefreshStore & UserSessionProvi
         return entity.isRememberMe();
     }
 
+    @Override
     public int getStarted() {
         return entity.getStarted();
     }
 
+    @Override
     public int getLastSessionRefresh() {
         return entity.getLastSessionRefresh();
     }
 
+    @Override
     public void setLastSessionRefresh(int lastSessionRefresh) {
+        if (lastSessionRefresh <= entity.getLastSessionRefresh()) {
+            return;
+        }
+
         if (offline) {
             // Received the message from the other DC that we should update the lastSessionRefresh in local cluster. Don't update DB in that case.
             // The other DC already did.
diff --git a/model/storage-private/src/main/java/org/keycloak/models/session/PersistentAuthenticatedClientSessionAdapter.java b/model/storage-private/src/main/java/org/keycloak/models/session/PersistentAuthenticatedClientSessionAdapter.java
index 791c68383d..b8b105002d 100644
--- a/model/storage-private/src/main/java/org/keycloak/models/session/PersistentAuthenticatedClientSessionAdapter.java
+++ b/model/storage-private/src/main/java/org/keycloak/models/session/PersistentAuthenticatedClientSessionAdapter.java
@@ -182,6 +182,9 @@ public class PersistentAuthenticatedClientSessionAdapter implements Authenticate
 
     @Override
     public void setTimestamp(int timestamp) {
+        if (timestamp <= model.getTimestamp()) {
+            return;
+        }
         model.setTimestamp(timestamp);
     }
 
diff --git a/model/storage-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java b/model/storage-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
index 2655a5932e..083985ad17 100644
--- a/model/storage-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
+++ b/model/storage-private/src/main/java/org/keycloak/models/session/PersistentUserSessionAdapter.java
@@ -250,6 +250,9 @@ public class PersistentUserSessionAdapter implements OfflineUserSessionModel {
 
     @Override
     public void setLastSessionRefresh(int seconds) {
+        if (seconds <= getLastSessionRefresh()) {
+            return;
+        }
         model.setLastSessionRefresh(seconds);
     }
 
diff --git a/server-spi/src/main/java/org/keycloak/models/AuthenticatedClientSessionModel.java b/server-spi/src/main/java/org/keycloak/models/AuthenticatedClientSessionModel.java
index 319d6e47ec..f3060fd337 100644
--- a/server-spi/src/main/java/org/keycloak/models/AuthenticatedClientSessionModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/AuthenticatedClientSessionModel.java
@@ -49,6 +49,11 @@ public interface AuthenticatedClientSessionModel extends CommonClientSessionMode
     }
 
     int getTimestamp();
+
+    /**
+     * Set the timestamp for the client session.
+     * If the timestamp is smaller or equal than the current timestamp, the operation is ignored.
+     */
     void setTimestamp(int timestamp);
 
     /**
diff --git a/server-spi/src/main/java/org/keycloak/models/UserSessionModel.java b/server-spi/src/main/java/org/keycloak/models/UserSessionModel.java
index 5962e4ae11..daacab66dd 100755
--- a/server-spi/src/main/java/org/keycloak/models/UserSessionModel.java
+++ b/server-spi/src/main/java/org/keycloak/models/UserSessionModel.java
@@ -58,6 +58,10 @@ public interface UserSessionModel {
 
     int getLastSessionRefresh();
 
+    /**
+     * Set the last session refresh timestamp for the user session.
+     * If the timestamp is smaller or equal than the current timestamp, the operation is ignored.
+     */
     void setLastSessionRefresh(int seconds);
 
     boolean isOffline();