fix: Time.now → Time.current + broken OAuth revocation scope

app/controllers/backend/identities_controller.rb

@@ -177,7 +177,7 @@ def revoke_sessions
       authorize @identity, :update?
 
       count = @identity.sessions.not_expired.count
-      @identity.sessions.not_expired.update_all(signed_out_at: Time.current, expires_at: Time.now)
+      @identity.sessions.not_expired.update_all(signed_out_at: Time.current, expires_at: Time.current)
 
       if count > 0
         @identity.create_activity(:revoke_all_sessions, owner: current_user, recipient: @identity, parameters: { count: count })
@@ -192,7 +192,7 @@ def revoke_sessions
     def revoke_session
       authorize @identity, :update?
       session = @identity.sessions.find(params[:session_id])
-      session.update!(signed_out_at: Time.current, expires_at: Time.now)
+      session.update!(signed_out_at: Time.current, expires_at: Time.current)
       @identity.create_activity(:revoke_all_sessions, owner: current_user, recipient: @identity, parameters: { count: 1 })
       flash[:success] = "Session revoked."
       redirect_to backend_identity_path(@identity)

app/controllers/identity_sessions_controller.rb

@@ -11,7 +11,7 @@ def index
 
   def destroy
     session = current_identity.sessions.not_expired.find(params[:id])
-    session.update!(signed_out_at: Time.now, expires_at: Time.now)
+    session.update!(signed_out_at: Time.current, expires_at: Time.current)
     session.create_activity :revoke, owner: current_identity, recipient: current_identity
 
     if request.headers["HX-Request"]
@@ -36,7 +36,7 @@ def destroy_all
       .where.not(id: current_session&.id)
 
     count = revoked_sessions.count
-    revoked_sessions.update_all(signed_out_at: Time.current, expires_at: Time.now)
+    revoked_sessions.update_all(signed_out_at: Time.current, expires_at: Time.current)
 
     if count > 0
       current_identity.create_activity :revoke_all_sessions, owner: current_identity, recipient: current_identity, parameters: { count: count }

app/helpers/sessions_helper.rb

@@ -77,7 +77,7 @@ def sign_out
       &.find_by(session_token: cookies.encrypted[:session_token])
 
     if session
-      session.update(signed_out_at: Time.now, expires_at: Time.now)
+      session.update(signed_out_at: Time.current, expires_at: Time.current)
       session.create_activity :sign_out, owner: current_identity, recipient: current_identity
     end
 
@@ -93,6 +93,6 @@ def sign_out_of_all_sessions(identity = current_identity)
     identity
       &.sessions
       &.where&.not(id: current_session&.id)
-      &.update_all(signed_out_at: Time.now, expires_at: Time.now)
+      &.update_all(signed_out_at: Time.current, expires_at: Time.current)
   end
 end

app/models/identity_session.rb

@@ -11,8 +11,8 @@ class IdentitySession < ApplicationRecord
   include PublicActivity::Model
   tracked owner: proc { |controller, record| record.identity }, recipient: proc { |controller, record| record.identity }, only: [ :create ]
 
-  scope :expired, -> { where("expires_at <= ?", Time.now) }
-  scope :not_expired, -> { where("expires_at > ?", Time.now) }
+  scope :expired, -> { where("expires_at <= ?", Time.current) }
+  scope :not_expired, -> { where("expires_at > ?", Time.current) }
   scope :recently_expired_within, ->(date) { expired.where("expires_at >= ?", date) }
 
   after_create_commit do
@@ -29,7 +29,7 @@ class IdentitySession < ApplicationRecord
 
   validate :identity_is_unlocked, on: :create
 
-  def expired? = expires_at <= Time.now
+  def expired? = expires_at <= Time.current
 
   def clear_metadata!
     update!(

app/models/oauth_token.rb

@@ -37,8 +37,8 @@ class OAuthToken < ApplicationRecord
   REFRESH_TOKEN_PREFIX = "idnrf."
   SIZE = 32
 
-  scope :not_expired, -> { where(expires_in: nil).or(where("(oauth_access_tokens.created_at + make_interval(secs => expires_in)) >= ?", Time.now)) }
-  scope :not_revoked, -> { where(revoked_at: nil).or(where(revoked_at: Time.now..)) }
+  scope :not_expired, -> { where(expires_in: nil).or(where("(oauth_access_tokens.created_at + make_interval(secs => expires_in)) >= ?", Time.current)) }
+  scope :not_revoked, -> { where(revoked_at: nil) }
 
   scope :accessible, -> { not_expired.and(not_revoked) }