From 86673291100fd16aaf216ed33ca9b648b8a2b7a5 Mon Sep 17 00:00:00 2001 From: hugocasa Date: Wed, 11 Mar 2026 11:47:21 +0100 Subject: [PATCH] fix: skip token expiry notifications for debugger and mcp-oauth tokens (#8316) * fix: skip token expiry notifications for debugger and mcp-oauth tokens Co-Authored-By: Claude Opus 4.5 * fix: update frontend isUserToken to match backend filter Co-Authored-By: Claude Opus 4.5 * chore: add cross-reference comments to token filter functions Co-Authored-By: Claude Opus 4.5 --------- Co-authored-by: Claude Opus 4.5 --- backend/src/monitor.rs | 11 ++++++++++- backend/windmill-api-auth/src/lib.rs | 10 +++++++++- .../src/lib/components/settings/TokensTable.svelte | 10 +++++++++- 3 files changed, 28 insertions(+), 3 deletions(-) diff --git a/backend/src/monitor.rs b/backend/src/monitor.rs index 48d8552905..d0b26a6b50 100644 --- a/backend/src/monitor.rs +++ b/backend/src/monitor.rs @@ -880,10 +880,19 @@ struct TokenRow { workspace_id: Option, } +/// When updating this filter, also update: +/// - `register_token_expiry_notification` in windmill-api-auth/src/lib.rs +/// - `isUserToken` in frontend/src/lib/components/settings/TokensTable.svelte fn is_user_token(label: Option<&str>) -> bool { match label { None => true, - Some(l) => l != "session" && !l.starts_with("ephemeral") && !l.starts_with("Ephemeral"), + Some(l) => { + l != "session" + && !l.starts_with("ephemeral") + && !l.starts_with("Ephemeral") + && l != "debugger-token" + && !l.starts_with("mcp-oauth-") + } } } diff --git a/backend/windmill-api-auth/src/lib.rs b/backend/windmill-api-auth/src/lib.rs index d5ec56d00e..557ce7f706 100644 --- a/backend/windmill-api-auth/src/lib.rs +++ b/backend/windmill-api-auth/src/lib.rs @@ -581,6 +581,9 @@ pub async fn create_token_internal( } /// Insert a pending expiry notification row for user tokens that have an expiration. +/// When updating this filter, also update: +/// - `is_user_token` in src/monitor.rs +/// - `isUserToken` in frontend/src/lib/components/settings/TokensTable.svelte pub async fn register_token_expiry_notification( tx: &mut sqlx::PgConnection, token: &str, @@ -589,7 +592,12 @@ pub async fn register_token_expiry_notification( ) { let Some(expiration) = expiration else { return }; if label == Some("session") - || label.is_some_and(|l| l.starts_with("ephemeral") || l.starts_with("Ephemeral")) + || label.is_some_and(|l| { + l.starts_with("ephemeral") + || l.starts_with("Ephemeral") + || l == "debugger-token" + || l.starts_with("mcp-oauth-") + }) { return; } diff --git a/frontend/src/lib/components/settings/TokensTable.svelte b/frontend/src/lib/components/settings/TokensTable.svelte index b26d55ed89..85513b951b 100644 --- a/frontend/src/lib/components/settings/TokensTable.svelte +++ b/frontend/src/lib/components/settings/TokensTable.svelte @@ -38,9 +38,17 @@ listTokens() }) + // When updating this filter, also update: + // - `is_user_token` in backend/src/monitor.rs + // - `register_token_expiry_notification` in backend/windmill-api-auth/src/lib.rs function isUserToken(label: string | undefined): boolean { if (!label) return true - return label !== 'session' && !label.toLowerCase().startsWith('ephemeral') + return ( + label !== 'session' && + !label.toLowerCase().startsWith('ephemeral') && + label !== 'debugger-token' && + !label.startsWith('mcp-oauth-') + ) } function daysUntilExpiration(expiration: string | undefined): number | null {