Clarify secret revocation timing and add types for the regenerate mutation

Motivation:

The documentation of token secret regeneration claims the old secret is
revoked immediately, but the revocation may take a short time to be propagated
to the authorization cache. The new webapp mutation and the secret modal state
were also untyped.

Modifications:

- Reword the Javadoc and the authentication documentation to note that the
  propagation of the revocation to the authorization cache may take a short
  time.
- Type the regenerate mutation response and the secret modal state with
  `AppIdentityDto`.

Result:

- The documentation matches the actual revocation timing and the regenerate
  flow is type-checked.

Author: ikhoon

server/src/main/java/com/linecorp/centraldogma/server/internal/api/sysadmin/AppIdentityRegistryService.java

@@ -251,8 +251,9 @@ public CompletableFuture<AppIdentity> updateAppIdentity(ServiceRequestContext ct
     /**
      * POST /appIdentities/{appId}/secret
      *
-     * <p>Regenerates the secret of the token of the specified {@code appId}. The old secret is revoked
-     * immediately and the token with a newly-generated secret is returned.
+     * <p>Regenerates the secret of the token of the specified {@code appId} and returns the token with
+     * a newly-generated secret. The old secret is revoked in the same commit, but it may take a short
+     * time for the revocation to be propagated to the authorization cache.
      */
     @Post("/appIdentities/{appId}/secret")
     public CompletableFuture<Token> regenerateTokenSecret(ServiceRequestContext ctx,

server/src/main/java/com/linecorp/centraldogma/server/metadata/MetadataService.java

@@ -1167,15 +1167,17 @@ public CompletableFuture<Revision> deactivateToken(Author author, String appId)
 
     /**
      * Regenerates the secret of the {@link Token} of the specified {@code appId} and returns the
-     * {@link Token} with the newly-generated secret. The old secret is revoked immediately.
+     * {@link Token} with the newly-generated secret. The old secret is revoked in the same commit,
+     * but it may take a short time for the revocation to be propagated to the authorization cache.
      */
     public CompletableFuture<Token> regenerateTokenSecret(Author author, String appId) {
         return appIdentityService.regenerateTokenSecret(author, appId);
     }
 
     /**
      * Regenerates the secret of the {@link Token} of the specified {@code appId} and returns the
-     * {@link Token} with the newly-generated secret. The old secret is revoked immediately.
+     * {@link Token} with the newly-generated secret. The old secret is revoked in the same commit,
+     * but it may take a short time for the revocation to be propagated to the authorization cache.
      * The regeneration fails with a {@link ChangeConflictException} if the token's creation metadata
      * does not match {@code expectedCreation}, which prevents rotating a token that was recreated
      * with the same application ID after the caller was authorized.

site/src/sphinx/auth.rst

@@ -370,8 +370,9 @@ creator and the system administrator are allowed to deactivate, remove and/or re
 
 If the secret of a token is leaked, the token creator or a system administrator can regenerate the secret
 with the ``Regenerate secret`` button of the web UI or ``POST /api/v1/appIdentities/{appId}/secret``.
-The old secret is revoked immediately and a newly-generated secret is issued to the same application ID,
-so the roles and permissions granted to the token are preserved.
+The old secret is revoked and a newly-generated secret is issued to the same application ID, so the roles
+and permissions granted to the token are preserved. Note that it may take a short time for the revocation
+to be propagated to the authorization cache of each server.
 
 There are two levels of a token, which are ``System Admin`` and ``User``. ``System Admin`` level token can be
 created by only the system administrators. A client who sends a request with the token is allowed to access

webapp/src/dogma/features/api/apiSlice.ts

@@ -367,7 +367,7 @@ export const apiSlice = createApi({
       }),
       invalidatesTags: ['AppIdentity'],
     }),
-    regenerateAppIdentitySecret: builder.mutation({
+    regenerateAppIdentitySecret: builder.mutation<AppIdentityDto, { appId: string }>({
       query: ({ appId }) => ({
         url: `/api/v1/appIdentities/${appId}/secret`,
         method: 'POST',

webapp/src/dogma/features/app-identity/RegenerateAppIdentitySecret.tsx

@@ -12,6 +12,7 @@ import {
   useDisclosure,
 } from '@chakra-ui/react';
 import { apiSlice, useRegenerateAppIdentitySecretMutation } from 'dogma/features/api/apiSlice';
+import { AppIdentityDto } from 'dogma/features/app-identity/AppIdentity';
 import { DisplaySecretModal } from 'dogma/features/app-identity/DisplaySecretModal';
 import { newNotification } from 'dogma/features/notification/notificationSlice';
 import ErrorMessageParser from 'dogma/features/services/ErrorMessageParser';
@@ -28,7 +29,7 @@ export const RegenerateAppIdentitySecret = ({ appId, hidden }: { appId: string;
   } = useDisclosure();
   const dispatch = useAppDispatch();
   const [regenerateSecret, { isLoading, reset }] = useRegenerateAppIdentitySecretMutation();
-  const [appIdentityDetail, setAppIdentityDetail] = useState(null);
+  const [appIdentityDetail, setAppIdentityDetail] = useState<AppIdentityDto | null>(null);
   const mounted = useRef(true);
   const invalidationPending = useRef(false);
   useEffect(() => {