count external jwts for telemetry

* feat: count external jwts

* nits

backend/.sqlx/query-778ab8ceb2a84978919ceb07f399468e01c4bee4cd755322eb2a83353a279a2b.json

@@ -0,0 +1,14 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO unique_ext_jwt_token (jwt_hash, last_used_at)\n         VALUES ($1, NOW())\n         ON CONFLICT (jwt_hash)\n         DO UPDATE SET last_used_at = NOW()",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int8"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "778ab8ceb2a84978919ceb07f399468e01c4bee4cd755322eb2a83353a279a2b"
+}

backend/.sqlx/query-d2732640f09ec029025ebdd4de502c8adee995eac05b5051e480f0a20fa6b7bb.json

@@ -0,0 +1,20 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT COUNT(*) FROM unique_ext_jwt_token WHERE last_used_at > NOW() - INTERVAL '30 days'",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "count",
+        "type_info": "Int8"
+      }
+    ],
+    "parameters": {
+      "Left": []
+    },
+    "nullable": [
+      null
+    ]
+  },
+  "hash": "d2732640f09ec029025ebdd4de502c8adee995eac05b5051e480f0a20fa6b7bb"
+}

backend/ee-repo-ref.txt

@@ -1 +1 @@
-785ec89a5fb08d62b5ef59d1860089ed1266ae8b
+6694dfbc62ff69570743f028aa19c543ae846e6e

backend/migrations/20251118190643_unique_jwt_token.down.sql

@@ -0,0 +1,3 @@
+-- Add down migration script here
+
+DROP TABLE IF EXISTS unique_ext_jwt_token;

backend/migrations/20251118190643_unique_jwt_token.up.sql

@@ -0,0 +1,9 @@
+-- Add up migration script here
+
+CREATE TABLE IF NOT EXISTS unique_ext_jwt_token (
+    jwt_hash BIGINT PRIMARY KEY NOT NULL,
+    last_used_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_unique_ext_jwt_token_last_used_at ON unique_ext_jwt_token(last_used_at);
+

backend/windmill-api/src/auth.rs

@@ -90,6 +90,7 @@ impl AuthCache {
                     w_id.as_ref(),
                     token.trim_start_matches("jwt_ext_"),
                     self.ext_jwks.clone(),
+                    &self.db,
                 )
                 .await
                 {

backend/windmill-api/src/ee_oss.rs

@@ -26,6 +26,7 @@ pub async fn jwt_ext_auth(
     _w_id: Option<&String>,
     _token: &str,
     _external_jwks: Option<Arc<RwLock<ExternalJwks>>>,
+    _db: &crate::db::DB,
 ) -> anyhow::Result<(crate::db::ApiAuthed, usize)> {
     // Implementation is not open source
 

backend/windmill-common/src/auth.rs

@@ -158,6 +158,21 @@ impl JWTAuthClaims {
                 .as_ref()
                 .is_some_and(|token_w_ids| token_w_ids.iter().any(|token_w_id| w_id == token_w_id))
     }
+
+    pub fn compute_ext_jwt_hash(&self) -> i64 {
+        let mut hasher = DefaultHasher::new();
+        self.email.hash(&mut hasher);
+        self.username.hash(&mut hasher);
+        self.is_admin.hash(&mut hasher);
+        self.is_operator.hash(&mut hasher);
+        self.groups.hash(&mut hasher);
+        self.folders.hash(&mut hasher);
+        self.workspace_id.hash(&mut hasher);
+        self.workspace_ids.hash(&mut hasher);
+        self.label.hash(&mut hasher);
+        self.scopes.hash(&mut hasher);
+        hasher.finish() as i64
+    }
 }
 
 #[derive(Deserialize, Debug)]

backend/windmill-common/src/utils.rs

@@ -947,3 +947,9 @@ pub struct ExpiringCacheEntry<T> {
     pub value: T,
     pub expiry: std::time::Instant,
 }
+
+impl<T> ExpiringCacheEntry<T> {
+    pub fn is_expired(&self) -> bool {
+        self.expiry < std::time::Instant::now()
+    }
+}