fix(credentials): keep saved-token expiry captions current and drop a past GitLab personal-token expiry

The integrations list and detail captions re-read the clock when the day
count drops or the token expires, instead of only on render. A GitLab
personal token's stated expiry that is already past is dropped, the same
check the service-account validators apply, now shared as
credibleTokenExpiry.

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/integrations/connected/[credentialId]/connected-credential-detail.tsx

@@ -19,7 +19,6 @@ import { formatDateTime } from '@sim/utils/formatting'
 import { useRouter } from 'next/navigation'
 import { SaveDiscardChips } from '@/components/settings/save-discard-actions'
 import { writeOAuthReturnContext } from '@/lib/credentials/client-state'
-import { savedTokenExpiryLabel } from '@/lib/credentials/expiry-label'
 import { resolveCredentialDisplay } from '@/lib/integrations/credential-display'
 import { ConnectOAuthModal } from '@/app/workspace/[workspaceId]/components/connect-oauth-modal'
 import {
@@ -40,6 +39,7 @@ import {
   type ServiceAccountProviderId,
 } from '@/app/workspace/[workspaceId]/integrations/components/connect-service-account-modal'
 import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
+import { useSavedTokenExpiryLabel } from '@/app/workspace/[workspaceId]/integrations/hooks/use-saved-token-expiry-label'
 import { SettingsEmptyState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 import {
   useCreateCredentialDraft,
@@ -100,6 +100,7 @@ export function ConnectedCredentialDetail({
   })
   const connectMicrosoftDataverseOAuthService = useConnectMicrosoftDataverseOAuthService()
   const isAdmin = credential?.role === 'admin'
+  const expiryLabel = useSavedTokenExpiryLabel(credential?.expiresAt)
 
   const [showDeleteConfirmDialog, setShowDeleteConfirmDialog] = useState(false)
   const [isShareModalOpen, setIsShareModalOpen] = useState(false)
@@ -335,8 +336,7 @@ export function ConnectedCredentialDetail({
         {credential.expiresAt && (
           <DetailSection title='Token expiry'>
             <span className='text-[var(--text-secondary)] text-small'>
-              {formatDateTime(new Date(credential.expiresAt), 'UTC')} ·{' '}
-              {savedTokenExpiryLabel(new Date(credential.expiresAt), Date.now())}
+              {formatDateTime(new Date(credential.expiresAt), 'UTC')} · {expiryLabel}
             </span>
           </DetailSection>
         )}

apps/sim/app/workspace/[workspaceId]/integrations/hooks/use-saved-token-expiry-label.test.tsx

@@ -0,0 +1,63 @@
+/**
+ * @vitest-environment jsdom
+ */
+
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useSavedTokenExpiryLabel } from '@/app/workspace/[workspaceId]/integrations/hooks/use-saved-token-expiry-label'
+
+const NOW = Date.parse('2026-11-11T12:00:00.000Z')
+const DAY_MS = 24 * 60 * 60 * 1000
+
+let container: HTMLDivElement
+let root: Root
+let label: string | undefined
+
+function Harness({ expiresAt }: { expiresAt?: string }) {
+  label = useSavedTokenExpiryLabel(expiresAt)
+  return null
+}
+
+function mount(expiresAt?: string) {
+  act(() => {
+    root.render(<Harness expiresAt={expiresAt} />)
+  })
+}
+
+describe('useSavedTokenExpiryLabel', () => {
+  beforeEach(() => {
+    vi.useFakeTimers({ now: NOW })
+    container = document.createElement('div')
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    vi.useRealTimers()
+  })
+
+  it('reads expired once the token expires while the page stays open', () => {
+    mount(new Date(NOW + 60_000).toISOString())
+    expect(label).toBe('expires in 1 day')
+    act(() => {
+      vi.advanceTimersByTime(60_000)
+    })
+    expect(label).toBe('expired')
+  })
+
+  it('counts the days down while the page stays open', () => {
+    mount(new Date(NOW + 2 * DAY_MS).toISOString())
+    expect(label).toBe('expires in 2 days')
+    act(() => {
+      vi.advanceTimersByTime(DAY_MS + 1)
+    })
+    expect(label).toBe('expires in 1 day')
+  })
+
+  it('has no caption for a token that states no expiry', () => {
+    mount(undefined)
+    expect(label).toBeUndefined()
+    expect(vi.getTimerCount()).toBe(0)
+  })
+})

apps/sim/app/workspace/[workspaceId]/integrations/hooks/use-saved-token-expiry-label.ts

@@ -0,0 +1,26 @@
+import { useEffect, useState } from 'react'
+import {
+  msUntilSavedTokenExpiryLabelChanges,
+  savedTokenExpiryLabel,
+} from '@/lib/credentials/expiry-label'
+
+/**
+ * The caption for a saved token's expiry, kept current while the page stays open: it re-reads the
+ * clock when the day count drops and when the token expires. `undefined` when the token states no
+ * readable expiry.
+ */
+export function useSavedTokenExpiryLabel(expiresAt: string | undefined): string | undefined {
+  const [now, setNow] = useState(() => Date.now())
+  const expiresAtMs = expiresAt ? new Date(expiresAt).getTime() : Number.NaN
+
+  useEffect(() => {
+    const untilChange = msUntilSavedTokenExpiryLabelChanges(new Date(expiresAtMs), now)
+    if (untilChange === null) return
+    const timer = setTimeout(() => setNow(Date.now()), untilChange)
+    return () => clearTimeout(timer)
+  }, [expiresAtMs, now])
+
+  return Number.isFinite(expiresAtMs)
+    ? savedTokenExpiryLabel(new Date(expiresAtMs), now)
+    : undefined
+}

apps/sim/app/workspace/[workspaceId]/integrations/integrations.tsx

@@ -14,7 +14,6 @@ import {
 import { Lock } from '@sim/emcn/icons'
 import { useParams } from 'next/navigation'
 import { useQueryStates } from 'nuqs'
-import { savedTokenExpiryLabel } from '@/lib/credentials/expiry-label'
 import {
   blockTypeToIconMap,
   formatIntegrationType,
@@ -27,6 +26,7 @@ import { IntegrationTabsHeader } from '@/app/workspace/[workspaceId]/components/
 import { IntegrationSection } from '@/app/workspace/[workspaceId]/integrations/components/integration-section'
 import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
 import { ShowcaseWithExplore } from '@/app/workspace/[workspaceId]/integrations/components/showcase-with-explore'
+import { useSavedTokenExpiryLabel } from '@/app/workspace/[workspaceId]/integrations/hooks/use-saved-token-expiry-label'
 import { useScrollRestoration } from '@/app/workspace/[workspaceId]/integrations/hooks/use-scroll-restoration'
 import {
   ALL_CATEGORY,
@@ -155,16 +155,17 @@ function ConnectedItem({
   icon: Icon,
   expiresAt,
 }: ConnectedItemProps) {
+  const expiryLabel = useSavedTokenExpiryLabel(expiresAt)
   return (
     <SettingsResourceRow
       iconVariant='custom'
       icon={<IntegrationTile blockType={blockType} icon={Icon} />}
       title={name}
       description={description}
       badge={
-        expiresAt ? (
+        expiryLabel ? (
           <span className='whitespace-nowrap text-[var(--text-muted)] text-caption'>
-            {savedTokenExpiryLabel(new Date(expiresAt), Date.now())}
+            {expiryLabel}
           </span>
         ) : undefined
       }

apps/sim/lib/credentials/expiry-label.ts

@@ -11,3 +11,13 @@ export function savedTokenExpiryLabel(expiresAt: Date, now: number): string {
   const days = Math.ceil(remainingMs / DAY_MS)
   return `expires in ${days} ${days === 1 ? 'day' : 'days'}`
 }
+
+/**
+ * How long until {@link savedTokenExpiryLabel} reads differently: until the day count drops, or
+ * until the token expires on its last day. `null` once it reads `expired`, which never changes.
+ */
+export function msUntilSavedTokenExpiryLabelChanges(expiresAt: Date, now: number): number | null {
+  const remainingMs = expiresAt.getTime() - now
+  if (!(remainingMs > 0)) return null
+  return remainingMs - (Math.ceil(remainingMs / DAY_MS) - 1) * DAY_MS
+}

apps/sim/lib/credentials/gitlab-personal-token.test.ts

@@ -95,6 +95,7 @@ describe('GitLab personal token verification', () => {
   it.each([
     ['midnight UTC on its expiry date', '2027-03-01', new Date('2027-03-01T00:00:00.000Z')],
     ['no expiry for a date that does not exist', '2027-02-30', null],
+    ['no expiry for a date already past', '2020-01-01', null],
   ])('records %s', async (_, expiresAt, expected) => {
     mocks.fetch
       .mockReset()

apps/sim/lib/credentials/gitlab-personal-token.ts

@@ -5,7 +5,7 @@ import { resourceScopeFromOwner, sameResourceScope } from '@/lib/core/resource-s
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { secureFetchWithValidation } from '@/lib/core/security/input-validation.server'
 import { isHostNotFound } from '@/lib/credentials/token-service-accounts/errors'
-import { gitlabTokenExpiration } from '@/lib/credentials/vendor-token-expiry'
+import { credibleTokenExpiry, gitlabTokenExpiration } from '@/lib/credentials/vendor-token-expiry'
 import { normalizeGitLabHost } from '@/tools/gitlab/utils'
 
 const gitLabUserSchema = z.object({
@@ -100,7 +100,7 @@ export async function verifyGitLabPersonalToken(accessToken: string, rawHost?: s
     instanceUrl,
     displayName: `${user.data.name || user.data.username} (${new URL(instanceUrl).host})`,
     grantedScopes: token.data.scopes,
-    expiresAt: gitlabTokenExpiration(token.data.expires_at) ?? null,
+    expiresAt: credibleTokenExpiry(gitlabTokenExpiration(token.data.expires_at)) ?? null,
   }
 }
 

apps/sim/lib/credentials/token-service-accounts/validators/http.ts

@@ -20,6 +20,7 @@ import type {
   TokenServiceAccountValidationResult,
   TokenServiceAccountValidator,
 } from '@/lib/credentials/token-service-accounts/server'
+import { credibleTokenExpiry } from '@/lib/credentials/vendor-token-expiry'
 
 interface TokenCheckRequest {
   url: string
@@ -98,18 +99,12 @@ interface TokenCheck {
   }) => Date | undefined
 }
 
-/**
- * The expiry a check states for an accepted token, when it is still ahead. The vendor just accepted
- * the token, so a stated expiry that has already passed contradicts the request (a misread value or
- * a skewed clock) and is dropped rather than recorded as fact; an imminent one is kept.
- */
+/** The expiry a check states for an accepted token, when it is credible. */
 function credibleExpiry(
   check: TokenCheck,
   accepted: { headers: ProviderResponse['headers']; body: unknown }
 ): Date | undefined {
-  const expiresAt = check.expiresAt?.(accepted)
-  if (!expiresAt || Number.isNaN(expiresAt.getTime())) return undefined
-  return expiresAt.getTime() > Date.now() ? expiresAt : undefined
+  return credibleTokenExpiry(check.expiresAt?.(accepted))
 }
 
 /** `accepted` with the expiry the check states, when there is a credible one. */

apps/sim/lib/credentials/vendor-token-expiry.ts

@@ -59,3 +59,13 @@ export function gitlabTokenExpiration(expiresAt: unknown): Date | undefined {
   const match = typeof expiresAt === 'string' ? /^(\d{4})-(\d{2})-(\d{2})$/.exec(expiresAt) : null
   return match ? calendarMomentUtc(match.slice(1, 4).map(Number)) : undefined
 }
+
+/**
+ * A stated expiry for a token the vendor just accepted, when it is still ahead. The acceptance
+ * proves the token works now, so a moment already past contradicts the request (a misread value or
+ * a skewed clock) and is dropped rather than recorded as fact; an imminent one is kept.
+ */
+export function credibleTokenExpiry(expiresAt: Date | undefined): Date | undefined {
+  if (!expiresAt || Number.isNaN(expiresAt.getTime())) return undefined
+  return expiresAt.getTime() > Date.now() ? expiresAt : undefined
+}