Make the PowerSync auth token lifetime configurable - #2428
Closed
nico-fioretti wants to merge 1 commit into
Closed
Conversation
The JWT the app requests to authenticate against the PowerSync service had a hard-coded 10 minute (600 s) lifetime. On self-hosted setups this forces the mobile client to refresh the sync token very frequently; when a refresh is missed (e.g. the app resumes from the background after the token has already expired) the sync stream can stall until the app storage is cleared and the user logs in again. Expose the lifetime as POWERSYNC_ACCESS_TOKEN_EXPIRES_IN (seconds), defaulting to the previous 600, and read it from the environment in the docker settings so operators can raise it without patching the source. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Member
|
Closing this PR as the token lifetime wasn't the culprit of the problems in the linked issue |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The JWT that the Flutter app requests to authenticate against the PowerSync service is created in
wger/core/api/powersync.pywith a hard-coded 600 s (10 min) lifetime:This PR makes that lifetime configurable via a new setting
POWERSYNC_ACCESS_TOKEN_EXPIRES_IN(seconds), defaulting to the previous600so behaviour is unchanged out of the box. On the docker settings it is read from the environment, so self-hosters can raise it without patching the source.Why
On self-hosted instances the 10-minute lifetime forces the mobile client to refresh the sync token very frequently. When a refresh is missed (typically when the app resumes from the background after the token has already expired) the PowerSync stream can stall, and the only reliable recovery is clearing the app storage and logging in again. The server logs the expected
PSYNC_S2103 JWT has expiredon/sync/streamin those windows.Being able to lengthen the token (e.g. to 1 h) sharply reduces how often the client sits with an expired token on resume, which reduces the frequency of these stalls, without any client-side change.
Changes
settings/settings_global.py: addPOWERSYNC_ACCESS_TOKEN_EXPIRES_IN = 600default.settings/main.py: readPOWERSYNC_ACCESS_TOKEN_EXPIRES_INfrom the environment (docker deployments).wger/core/api/powersync.py: use the setting instead of the hard-coded600.wger/core/tests/test_powersync.py: addPowerSyncTokenLifetimeTestCaseasserting the default and an override are honoured.Compatibility
Default is unchanged (600 s), so existing deployments behave exactly as before unless they opt in by setting the env var.