fix: simple auth tokens no longer expire after 1 hour - #256
melvincarvalho merged 3 commits into
Conversation
Sorry, something went wrong.
Pod creation tokens now have no expiry since there is no refresh mechanism in simple auth mode. OAuth tokens keep 1-hour expiry. Closes #255
There was a problem hiding this comment.
Pull request overview
This PR updates the simple HMAC-signed token infrastructure so that “simple auth” pod creation tokens no longer expire after 1 hour (since there’s no refresh path in that mode), while keeping OAuth (ActivityPub) access tokens on a 1-hour TTL.
Changes:
- Make createToken() omit the exp claim unless an explicit expiresIn is provided.
- Update OAuth token issuance paths to pass an explicit 3600 seconds expiry.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/auth/token.js | Changes createToken() to optionally include exp so simple-mode tokens can be non-expiring. |
| src/ap/routes/oauth.js | Passes explicit 1-hour expiry for OAuth-issued access tokens. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
| export function createToken(webId, expiresIn) { | ||
| const payload = { | ||
| webId, | ||
| iat: Math.floor(Date.now() / 1000), | ||
| exp: Math.floor(Date.now() / 1000) + expiresIn | ||
| }; | ||
| if (expiresIn) { | ||
| payload.exp = Math.floor(Date.now() / 1000) + expiresIn; | ||
| } |
Copilot
AI
Apr 3, 2026
There was a problem hiding this comment.
if (expiresIn) treats 0 (and NaN) as “no expiry”, producing a non-expiring token even though the caller provided an expiresIn value. Consider validating the parameter (e.g., require a finite number and check expiresIn !== undefined / expiresIn > 0) so accidental falsy values can’t silently disable expiration.
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
| export function createToken(webId, expiresIn) { | ||
| const payload = { | ||
| webId, | ||
| iat: Math.floor(Date.now() / 1000), | ||
| exp: Math.floor(Date.now() / 1000) + expiresIn | ||
| }; | ||
| if (expiresIn !== undefined && expiresIn > 0) { | ||
| payload.exp = Math.floor(Date.now() / 1000) + expiresIn; | ||
| } |
Copilot
AI
Apr 3, 2026
There was a problem hiding this comment.
expiresIn is treated as “no expiry” unless it’s > 0, which means non-numeric values (e.g., a string, NaN, null) will silently produce a non-expiring token. To avoid accidental non-expiring tokens if a caller ever forwards config/user input, consider validating the type (e.g., typeof expiresIn === 'number' && Number.isFinite(expiresIn) && expiresIn > 0) and otherwise either omit exp explicitly (documented) or throw.
Sorry, something went wrong.
| /** | ||
| * Create a simple token for a WebID | ||
| * @param {string} webId - The WebID to create token for | ||
| * @param {number} expiresIn - Expiration time in seconds (default 1 hour) | ||
| * @param {number} [expiresIn] - Expiration time in seconds (default: no expiry) | ||
| * @returns {string} Token string | ||
| */ |
Copilot
AI
Apr 3, 2026
There was a problem hiding this comment.
With createToken() now able to omit exp, the token module’s docs/types should reflect that exp is optional (e.g., the file header comment describing the payload shape and the verifyToken() JSDoc return type currently imply exp is always present). Updating those docs will help avoid confusion for future callers.
Sorry, something went wrong.
Summary
Closes #255
Test plan