Arvados

Steps to reproduce:

1. Log into Workbench on a Curii cluster.
2. User menu→Get API token
3. Note the token expires in 14 days, per cluster configuration.
4. Close the dialog.
5. User menu→Get API token

Expected behavior: The token still expires in 14 days.

Actual behavior: The dialog reports that the token expires in 5 minutes. This is apparently a Workbench display bug: fetching the API token with another client still reports the expected expires_at. This behavior appears across clients. You can replace step 5 with arv api_client_authorization current (using the token you got in step 2) and see a 5-minute expiry there too.

Proposed solution:

Add an internal column called refresh_at which determines when the token expires or must be refreshed. It is set to the earlier of expires_at or now + token refresh time (only if the token is federated).

Token validation only checks this new column.

This way, expires_at reflects the upstream value, but the actual API server behavior is what we want.