Ory Cloud Sessions page has incorrect instructions on admin capabilities

Benehiko commented 2 years ago

Preflight checklist

[X] I could not find a solution in the existing issues, docs, nor discussions.
[X] I agree to follow this project's Code of Conduct.
[X] I have read and am following this repository's Contribution Guidelines.
[X] This issue affects my Ory Cloud project.
[X] I have joined the Ory Community Slack.
[X] I am signed up to the Ory Security Patch Newsletter.

Describe the bug

The Ory Cloud documentation on Session management is incorrect. The guide suggests that sessions can be refreshed from an admin endpoint, but they can only be extended.

https://www.ory.sh/docs/guides/session-management/refresh-extend-sessions

Please also take a look at the handler in Kratos:

https://github.com/ory/kratos/blob/master/session/handler.go#L48-L73

Reproducing the bug

Go to the Ory Docs page https://www.ory.sh/docs/guides/session-management/refresh-extend-sessions
Try refresh a session as suggested in the documentation

curl https://<slug>.projects.oryapis.com/admin/sessions/40f83b8b-4f15-48eb-8c27-ff75c60757d8/refresh -H "Authorization: Bearer ory_pat_x"    
404 page not found

Relevant log output

No response

Relevant configuration

No response

Version

master

On which operating system are you observing this issue?

Ory Cloud

In which environment are you deploying?

Ory Cloud

Additional Context

No response

Benehiko commented 2 years ago

@tomekpapiernik we should get this fixed. I see also the formatting of the guide isn't right.

tomekpapiernik commented 2 years ago

Let me know what the call should look like and I'd be happy to update it. I'm not sure what you mean by formatting of the guide isn't right, though. Elaborate, please?

Benehiko commented 2 years ago

It looks like the formatting issue was fixed in this commit

https://github.com/ory/docs/commit/706b5d6fcef61a77b44d268793f7655140ca1c2b

To reproduce the problem, list all of your active sessions (you can find your user ID under the console https://console.ory.sh/projects/<project-id>/identities:

Then call the sessions endpoint to list all of your active sessions

curl https://auth.terblanche.eu/admin/identities/<user-id>/sessions -H "Authorization: Bearer ory_pat_<token>" | jq

[
  {
    "id": "<session id>",
    "active": true,
    "expires_at": "2022-02-12T09:58:07.619762Z",
    "authenticated_at": "2022-02-11T09:58:07.619762Z",
    "authenticator_assurance_level": "aal1",
    "authentication_methods": [
      {
        "method": "password",
        "aal": "",
        "completed_at": "2022-02-11T09:58:07.619754282Z"
      }
    ],
    "issued_at": "2022-02-11T09:58:07.619762Z",
    "identity": {
      "id": "",
      "schema_id": "preset://email",
      "schema_url": "",
      "state": "active",
      "state_changed_at": "2022-02-10T13:57:53.668318Z",
      "traits": {
        "email": "email@example.com"
      },
      "verifiable_addresses": [
        {
          "id": "",
          "value": "email@example.com",
          "verified": false,
          "via": "email",
          "status": "sent",
          "created_at": "2022-02-10T13:57:53.705359Z",
          "updated_at": "2022-02-10T13:57:53.705359Z"
        }
      ],
      "recovery_addresses": [
        {
          "id": "",
          "value": "email@example.com",
          "via": "email",
          "created_at": "2022-02-10T13:57:53.712317Z",
          "updated_at": "2022-02-10T13:57:53.712317Z"
        }
      ],
      "metadata_public": null,
      "created_at": "2022-02-10T13:57:53.676513Z",
      "updated_at": "2022-02-10T13:57:53.676513Z"
    }
  }
]

Try call the refresh sessions endpoint:

curl -X PATCH "https://<project-url>/admin/sessions/<session-id>/refresh" -H "Authorization: Bearer ory_pat_<token>"    
404 page not found

refresh doesn't exist, only extend does. Try look for the refresh endpoint in our Kratos codebase https://github.com/ory/kratos/blob/master/session/handler.go#L63

Also in the documentation for our HTTP Api references, only extend exists: https://www.ory.sh/docs/reference/api#operation/adminExtendSession

tomekpapiernik commented 1 year ago

The sample cURL now uses the correct /extend endpoint. https://www.ory.sh/docs/guides/session-management/refresh-extend-sessions

ory / docs