# OAuth2 Token Expiration Detector
# Captures the expires_in value to track token lifetime
# Example: {"access_token": "...", "expires_in": 3600, "token_type": "Bearer"}
#
# This helps with token refresh timing and debugging
#
# Created: December 2024
# Author: Web Performance Inc

# Detector type: Sticky Regular Expression Assignment Detector

# Descriptive name
detector.name=OAuth2 Token Expiration (JSON)

# Pattern to capture expires_in value (number of seconds)
# Handles both quoted and unquoted numeric values
search.pattern="expires_in"\\s*:\\s*"?(\d+)"?

# JSON responses only
content_type.pattern=(?i).*json.*|.*javascript.*|.*html.*

# Single capture group for the expiration time
groups.count=1

# Make it sticky to track token lifetime
group1.sticky=true

# Equivalency family for token metadata
equivalency.name.family=OAuth2-Metadata

# No unescaping needed for numbers
unescape.source=NONE

# Enable detector
detector=sread

# Platform detection metadata
platform=oauth2
detection.hint=JSON with "access_token", "refresh_token", "token_type", or "Bearer" authorization
