core/authorize: check for expired tokens (#4543)

* core/authorize: check for expired tokens

* Update pkg/grpc/session/session.go

Co-authored-by: Denis Mishin <dmishin@pomerium.com>

* lint

* fix zero timestamps

* fix

---------

Co-authored-by: Denis Mishin <dmishin@pomerium.com>

pkg/grpc/user/user_test.go

@@ -0,0 +1,30 @@
+package user
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+func TestServiceAccount_Validate(t *testing.T) {
+	t.Parallel()
+
+	t0 := timestamppb.New(time.Now().Add(-time.Second))
+	for _, tc := range []struct {
+		name           string
+		serviceAccount *ServiceAccount
+		expect         error
+	}{
+		{"valid", &ServiceAccount{}, nil},
+		{"expired", &ServiceAccount{ExpiresAt: t0}, ErrServiceAccountExpired},
+	} {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			assert.ErrorIs(t, tc.serviceAccount.Validate(), tc.expect)
+		})
+	}
+}