apps: stop planning an update on every deploy

acceptance/bundle/generate/app_not_yet_deployed/output.txt

@@ -10,6 +10,7 @@
     "message": "App compute is stopped.",
     "state": "STOPPED"
   },
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "my-app",
   "service_principal_client_id": "[UUID]",

acceptance/bundle/resources/apps/create_already_exists/output.txt

@@ -19,6 +19,7 @@
     "state": "ACTIVE"
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-app-already-exists",
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "test-app-already-exists",
   "service_principal_client_id": "[UUID]",

acceptance/cmd/workspace/apps/output.txt

@@ -21,6 +21,7 @@
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-name",
   "description": "My app description.",
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "test-name",
   "resources": [
@@ -62,6 +63,7 @@
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-name",
   "description": "My app description.",
+  "forward_user_access_token": true,
   "id": "1001",
   "name": "test-name",
   "resources": [

bundle/direct/dresources/resources.yml

@@ -555,6 +555,10 @@ resources:
     backend_defaults:
       # Backend sets it "MEDIUM" when not specified in the config
       - field: compute_size
+      # Backend enables token forwarding and reports true even when the config omits it,
+      # so an omitted field would otherwise plan an update on every deploy. An explicit
+      # value in the config still diffs normally.
+      - field: forward_user_access_token
       # lifecycle.started is derived from remote compute status in RemapState, so the
       # remote side always has a value. When the user omits lifecycle from config,
       # both old and new are nil and backend_defaults correctly skips the remote value.

libs/testserver/apps.go

@@ -329,6 +329,10 @@ func (s *FakeWorkspace) AppsUpsert(req Request, name string) Response {
 		app.ComputeSize = "MEDIUM"
 	}
 
+	// The platform enables user access token forwarding regardless of what the
+	// request asked for, so the remote always reports true.
+	app.ForwardUserAccessToken = true
+
 	// Assign a service principal to the app, mimicking the real platform.
 	if app.ServicePrincipalClientId == "" {
 		app.ServicePrincipalClientId = nextUUID()