Access token expiration by jdolle · Pull Request #7893 · graphql-hive/console

jdolle · 2026-03-21T02:41:35Z

Background

Tokens require manual deletion at present. For security purposes, often it's preferred to automatically expire tokens.

Relates to #7242

Description

This adds token expiration to all token types and slightly improves the spacing on the tokens UI for readability/UX.

Checklist

Input validation
Authentication management
Session management
Testing

gemini-code-assist · 2026-03-21T02:42:11Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the security posture of the application by introducing token expiration functionality across all access token types. It provides users with granular control over token lifetimes, reducing the risk associated with long-lived credentials. The changes span database schema updates, GraphQL API enhancements, and corresponding user interface modifications for a seamless experience.

Highlights

Token Expiration: Implemented automatic expiration for all token types (organization, project, and personal access tokens) to enhance security. Users can now define an expiration period (e.g., one week, one month, one year, or never) when creating a token.
Database Migration: A new database migration was added to introduce an 'expires_at' TIMESTAMP WITH TIME ZONE column to the 'organization_access_tokens' table, storing the expiration date for each token.
GraphQL API Updates: The GraphQL schema was extended to include an 'expirationPeriod' input for token creation mutations and an 'expiresAt' field for token types. Queries for access tokens now support an 'includeExpired' argument to fetch or filter expired tokens.
UI/UX Improvements: The access token creation forms and tables in the web application were updated to include options for setting expiration periods and displaying the expiration status. Minor spacing adjustments were also made to improve readability.
Token Validation Logic: The backend logic for fetching and validating access tokens was updated to respect the new 'expires_at' field, ensuring that expired tokens are not considered valid unless explicitly requested.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

github-actions · 2026-03-21T02:43:25Z

🚀 Snapshot Release (`alpha`)

The latest changes of this PR are available as alpha on npm (based on the declared changesets):

Package	Version	Info
`hive`	`11.0.0-alpha-20260324215528-a29ac28e6f0702de5993012124c6374fa22aa408`	npm ↗︎ unpkg ↗︎

gemini-code-assist

Code Review

This pull request introduces token expiration, a valuable security enhancement. My review has identified a critical caching issue that could lead to expired tokens being treated as valid, a regression in one of the GraphQL resolvers that breaks existing behavior, and a minor bug in a UI helper function. I've also noted an inconsistency in the GraphQL schema where a new field is added but not implemented. Please address these points to ensure the feature is robust and correct.

github-actions · 2026-03-21T02:52:20Z

🐋 This PR was built and pushed to the following Docker images:

Targets: build

Platforms: linux/amd64

Image Tag: a29ac28e6f0702de5993012124c6374fa22aa408

jdolle · 2026-03-23T23:07:34Z

+              await pool.end();
+              expect(result.rowCount).toBe(tokenIds.length);
+              for (const id of tokenIds) {
+                await purgeOrganizationAccessTokenById(id);


must purge cache after setting expiration else the old expiratin value will remain

jdolle · 2026-03-23T23:10:20Z

+    """
+    Set this in order to automatically expire this token after a period of time.
+    """
+    expirationPeriod: TokenExpirationPeriod = NEVER


I initially had this as non-nullable because it has a default, but our generated types still think it's nullable and i got a linting error about adding non-nullable arguments. I didn't want to tackle this issue so I made this nullable for now.

jdolle · 2026-03-23T23:10:48Z

          ? 'text-neutral-12 bg-neutral-5 hover:bg-neutral-5 dark:bg-neutral-3 dark:hover:bg-neutral-3'
          : 'text-neutral-11 hover:bg-transparent hover:underline',
-        'justify-start',
+        'h-auto justify-start text-left',


Fixes some spacing issues when the page width is small.

jdolle · 2026-03-23T23:14:55Z


  return (
-    <Sheet.SheetContent className="flex max-h-screen min-w-[700px] flex-col overflow-y-scroll">
+    <Sheet.SheetContent className="max-w-screen flex max-h-screen w-[700px] min-w-[60%] flex-col overflow-y-scroll">


prevents overflowing on small page width

jdolle · 2026-03-23T23:15:37Z

                  <tr key={permission.permission.id}>
-                    <td>{permission.permission.title}</td>
-                    <td className="ml-2 text-right">
+                    <td className="pl-2">{permission.permission.title}</td>


adds some indent to make the permission look correctly nested under the permission group

jdolle · 2026-03-23T23:15:56Z

                          </Tooltip.TooltipProvider>
                        ) : (
-                          <Badge variant="success">Allowed</Badge>
+                          <Badge className="w-[69px] justify-center" variant="success">


makes the badges the same width and centers the text

jdolle · 2026-03-23T23:17:37Z

  variants: {
    variant: {
-      horizontal: 'flex-row items-center justify-between',
+      horizontal: 'flex-row items-center justify-between flex-wrap',


allow the stepper items (the 1, 2, 3, 4 steps) to wrap. This prevents them from overflowing on small width pages.

jonathanawesome · 2026-03-24T16:30:05Z

Only suggestion here would be to highlight expired tokens. Perhaps the "expired" text should be text-red-500?

n1ru4l

Great 😍

jdolle added 2 commits March 20, 2026 19:37

Add expiration to tokens; improve layout spacing for tokens

047b3ab

Changeset

6745a38

jdolle requested a review from n1ru4l March 21, 2026 02:41

jdolle self-assigned this Mar 21, 2026

gemini-code-assist Bot reviewed Mar 21, 2026

View reviewed changes

Fix types

13f6610

jdolle added 4 commits March 23, 2026 09:20

Fix caching; other minor improvements

f8726d5

Add expiration to token detail page; fix token cache

55d6939

Fix lint

c73b49d

Add tests for expired org and personal tokens

863300b

jdolle marked this pull request as ready for review March 23, 2026 23:04

Merge branch 'main' into access-token-expiration

4f6d323

jdolle commented Mar 23, 2026

View reviewed changes

jdolle requested a review from jonathanawesome March 24, 2026 16:13

Use red text for expired tokens

a29ac28

jonathanawesome approved these changes Mar 24, 2026

View reviewed changes

n1ru4l approved these changes Mar 25, 2026

View reviewed changes

n1ru4l merged commit e5711a5 into main Mar 25, 2026
25 checks passed

n1ru4l deleted the access-token-expiration branch March 25, 2026 07:34

theguild-bot mentioned this pull request Mar 25, 2026

Upcoming Release Changes #7906

Merged

jdolle mentioned this pull request Mar 25, 2026

Add project access token expiration in the UI #7909

Merged

theguild-bot mentioned this pull request Mar 26, 2026

Upcoming Release Changes #7916

Closed

n1ru4l pushed a commit that referenced this pull request Apr 10, 2026

feat: access token expiration (#7893)

67b8721

Uh oh!

Conversation

jdolle commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Background

Description

Checklist

Uh oh!

gemini-code-assist Bot commented Mar 21, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

github-actions Bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Snapshot Release (alpha)

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jdolle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

jdolle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

jdolle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

jdolle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

jdolle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

jdolle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

jdolle Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

jonathanawesome commented Mar 24, 2026

Uh oh!

n1ru4l left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

jdolle commented Mar 21, 2026 •

edited

Loading

github-actions Bot commented Mar 21, 2026 •

edited

Loading

🚀 Snapshot Release (`alpha`)

github-actions Bot commented Mar 21, 2026 •

edited

Loading