New setting to specify the maximum number of active access tokens a user is allowed#59731
Conversation
…rce it during create
| subjectUserID, pq.Array(scopes), hashutil.ToSHA256Bytes(b[:]), note, creatorUserID, dbutil.NullTimeColumn(expiresAt), internal, conf.AccessTokensMaxPerUser(), | ||
| ).Scan(&id); err != nil { | ||
| // if creation failed check to see if it was because too many tokens already | ||
| count, countErr := s.Count(ctx, AccessTokensListOptions{SubjectUserID: subjectUserID}) |
There was a problem hiding this comment.
I guess technically we should be doing those two DB calls in a transaction for maximum correctness, but not sure it's worth the extra work.
There was a problem hiding this comment.
Yeah I debated that but figured since it's already failed and the likely reason is that it's too many tokens it's just a matter of this supplying a nicer error.
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
Add a setting to limit the number of active access tokens a user can have at a one time, the default value is 25 tokens. Internal access tokens do not count towards the active limit. Override of this default is available using the
maxTokensPerUsersetting in theauth.AccessTokenssection of the site config.This change does not effect existing tokens, if a user is over the limit no tokens are invalidated however they will not be able to create new tokens without first removing enough to get below the limit.
closes https://github.com/sourcegraph/sourcegraph/issues/59544
Test plan
tests add
manual test of access token page and call back page