Fix session expiration calculation

A tolerance is provided when calculating the expiration of a session.
Unfortunately, this tolerance was incorrectly applied and caused the
session to not be considered expired until the tolerance (15 minutes)
after the expiration had passed.

Author: miquella

lib/session.go

@@ -56,7 +56,7 @@ func (s *Session) Clone() *Session {
 }
 
 func (s *Session) Expired(tolerance time.Duration) bool {
-	return s.Expiration.Before(time.Now().Add(-tolerance))
+	return time.Now().Add(tolerance).After(s.Expiration)
 }
 
 func (s *Session) AssumeSessionRole() (*Session, error) {

lib/session_test.go

@@ -7,6 +7,18 @@ import (
 	"time"
 )
 
+func TestSessionExpiration(t *testing.T) {
+	s := Session{
+		Expiration: time.Now().Add(15 * time.Minute),
+	}
+	if s.Expired(10 * time.Minute) {
+		t.Errorf("Session manifesting as expired, but shouldn't be")
+	}
+	if !s.Expired(15 * time.Minute) {
+		t.Errorf("Session not manifesting as expired, but should be")
+	}
+}
+
 func TestSessionVariables(t *testing.T) {
 	s := Session{
 		Name:       "vault",