Skip to content

Access token expiry#1513

Merged
netomi merged 9 commits intoeclipse:masterfrom
amvanbaren:feature/issue-1368
Mar 4, 2026
Merged

Access token expiry#1513
netomi merged 9 commits intoeclipse:masterfrom
amvanbaren:feature/issue-1368

Conversation

@amvanbaren
Copy link
Contributor

@amvanbaren amvanbaren commented Dec 30, 2025

Fixes #1368

New configuration properties to be documented in Wiki:

  • ovsx.mail.access-token-expiry.subject (default '')
  • ovsx.mail.access-token-expiry.template (default '')
  • ovsx.access-token.prefix replaces existing ovsx.token-prefix
  • ovsx.access-token.expiration (default P90D)
  • ovsx.access-token.notification (default P7D)
  • ovsx.access-token.max-token-notifications (default 100)
  • ovsx.access-token.expiration-schedule (default every 15 min)
  • ovsx.access-token.notification-schedule (default every 15 min)

@amvanbaren amvanbaren self-assigned this Dec 30, 2025
@netomi netomi self-requested a review January 12, 2026 13:45
@netomi netomi added server (Component: server) Backend platform and service-side functionality security Vulnerabilities or improvements to harden security and protect user data labels Jan 12, 2026
@netomi
Copy link
Contributor

netomi commented Mar 4, 2026

overhauled the mechanism to expire personal access tokens:

  • make the expiration time configurable and add a column to the entity when it expires
  • add a column to the entity if a notification has already been sent out to avoid duplicate mails
  • display the expiration in the frontend as well
  • refactor code related to access tokens to a separate AccessTokenService
  • rename the existing TokenService to EclipseTokenService to avoid confusion
  • cleanup and adjust tests
  • when an expiration is configured, when the server starts up a job is scheduled to set the expiration time for existing legacy token to current_time + expiration

amvanbaren and others added 6 commits March 4, 2026 19:24
# Conflicts:
#	server/src/main/java/org/eclipse/openvsx/repositories/RepositoryService.java
#	server/src/test/java/org/eclipse/openvsx/repositories/RepositoryServiceSmokeTest.java
…existing TokenService to EclipseTokenService, cleanup tests
@netomi netomi force-pushed the feature/issue-1368 branch from a38b86a to 0508ab2 Compare March 4, 2026 18:26
@netomi netomi merged commit 6f59ad9 into eclipse:master Mar 4, 2026
4 checks passed
@netomi
Copy link
Contributor

netomi commented Mar 4, 2026

updated wiki

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

security Vulnerabilities or improvements to harden security and protect user data server (Component: server) Backend platform and service-side functionality

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Set PAT expiration period

2 participants