Skip to content

feat(cache): allow non-expiring api tokens#1

Open
Uzaaft wants to merge 2 commits into
masterfrom
push-zuwwvpotnvlt
Open

feat(cache): allow non-expiring api tokens#1
Uzaaft wants to merge 2 commits into
masterfrom
push-zuwwvpotnvlt

Conversation

@Uzaaft
Copy link
Copy Markdown
Contributor

@Uzaaft Uzaaft commented Apr 27, 2026

No description provided.

Uzaaft added 2 commits April 27, 2026 13:57
Tokens can now be created with no expiry by passing expiresInDays: null to the admin create endpoint, or --expires never on the CLI. The JWT exp claim becomes optional and the api_tokens.expires_at column is nullable.


Previous behavior required a finite lifetime between 1 and 365 days (default 90). Long-running automation had to rotate tokens periodically. The new flow lets operators opt in to forever-tokens explicitly while keeping the safe default: omitting expiresInDays still yields the 90-day token, only an explicit null disables expiry.


verifyJwt skips the exp comparison when the claim is absent and rejects malformed exp values otherwise. deleteExpiredApiTokens leaves rows with expires_at IS NULL untouched because SQL NULL comparisons are unknown. Added admin-tokens.spec.ts covering the admin endpoint, JWT round-trip, expiry cleanup, and a 67-year time-warp via vi.setSystemTime to confirm the never-expiring path.
Generated by drizzle-kit after relaxing the NOT NULL constraint on api_tokens.expires_at in schema.ts. SQLite cannot drop NOT NULL via ALTER TABLE, so the migration recreates the table via the standard rename-and-copy pattern.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant