Skip to content

Conversation

jonas-w
Copy link
Collaborator

@jonas-w jonas-w commented Jul 14, 2025

Summary

This should fix #95

  • JWTTokenProvider now has an __expiration attribute.
  • this attribute gets set by the set_expiration method, which does the following:
  1. parses the claims from the jwt -> if this fails, InvalidOrExpiredJWTTokenError
  2. converts the jti claim to an UUID
  3. retrieves all user generated tokens via get_tokens -> if this API call fails, the exception will be thrown too, as this means the JWT Token is expired
  4. searches for the token_id in the retrieved tokens, if matched, then the __expiration attribute will be set
  • the token() property, now checks for the __expiration time if it's set

Checklist

  • You agree with our CLA
  • Included tests (or is not applicable).
  • Updated documentation (or is not applicable).
  • Used pre-commit hooks to format and lint the code.

return
token_id = self._decode_token_id()
try:
tokens = ctx.multipass.get_tokens() # retrieve all tokens the user has generated
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the performance penalty of this call?
Wouldn't this call fail in case the token used to make this request is already expired?

Copy link
Collaborator Author

@jonas-w jonas-w Jul 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes if this call fails, as mentioned in the PR, the same exception will be thrown (this call is inside a try except block, which on except throws the InvalidOrExpiredJWTTokenError).

This will only be called on creation of the FoundryContext, so it will only increase startup time and not decrease performance for every api request, and for me it takes around 300-500ms for this init step (which is the same time it takes for every other api call with my internet connection)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this could theoretically be cached, so per jwt it would only need to do this request one time, and then save it into a json file, which holds all expiration times for each token id

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature Request]: More user-friendly error message when token is invalid/expired

2 participants