Merge commit from fork

* fix: prevent intent token reuse and add expiry

* fix duplicate

* fix expiration

internal/idp/providers/saml/session.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"net/http"
 	"net/url"
+	"time"
 
 	"github.com/crewjam/saml"
 	"github.com/crewjam/saml/samlsp"
@@ -107,6 +108,13 @@ func (s *Session) FetchUser(ctx context.Context) (user idp.User, err error) {
 	return userMapper, nil
 }
 
+func (s *Session) ExpiresAt() time.Time {
+	if s.Assertion == nil || s.Assertion.Conditions == nil {
+		return time.Time{}
+	}
+	return s.Assertion.Conditions.NotOnOrAfter
+}
+
 func (s *Session) transientMappingID() (string, error) {
 	for _, statement := range s.Assertion.AttributeStatements {
 		for _, attribute := range statement.Attributes {