fix(credentials): time a reconnected token's expiry caption from now and reject out-of-range GitHub offsets

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/integrations/hooks/use-saved-token-expiry-label.test.tsx

@@ -55,6 +55,28 @@ describe('useSavedTokenExpiryLabel', () => {
     expect(label).toBe('expires in 1 day')
   })
 
+  it('times a reconnected token from the moment it arrives, not from when the page opened', () => {
+    mount(new Date(NOW + 3 * DAY_MS).toISOString())
+    act(() => {
+      vi.advanceTimersByTime(6 * 60 * 60 * 1000)
+    })
+    mount(new Date(Date.now() + 60 * 60 * 1000).toISOString())
+    expect(label).toBe('expires in 1 day')
+    act(() => {
+      vi.advanceTimersByTime(60 * 60 * 1000)
+    })
+    expect(label).toBe('expired')
+  })
+
+  it('counts a token that gains an expiry after the page has been open for days from now', () => {
+    mount(undefined)
+    act(() => {
+      vi.advanceTimersByTime(3 * DAY_MS)
+    })
+    mount(new Date(Date.now() + 60 * 60 * 1000).toISOString())
+    expect(label).toBe('expires in 1 day')
+  })
+
   it('has no caption for a token that states no expiry', () => {
     mount(undefined)
     expect(label).toBeUndefined()

apps/sim/app/workspace/[workspaceId]/integrations/hooks/use-saved-token-expiry-label.ts

@@ -6,17 +6,24 @@ import {
 
 /**
  * The caption for a saved token's expiry, kept current while the page stays open: it re-reads the
- * clock when the day count drops and when the token expires. `undefined` when the token states no
- * readable expiry.
+ * clock when the expiry changes (a reconnect), when the day count drops, and when the token
+ * expires. `undefined` when the token states no readable expiry.
  */
 export function useSavedTokenExpiryLabel(expiresAt: string | undefined): string | undefined {
-  const [now, setNow] = useState(() => Date.now())
   const expiresAtMs = expiresAt ? new Date(expiresAt).getTime() : Number.NaN
+  const [clock, setClock] = useState(() => ({ expiresAtMs, now: Date.now() }))
+  if (!Object.is(clock.expiresAtMs, expiresAtMs)) {
+    setClock({ expiresAtMs, now: Date.now() })
+  }
+  const { now } = clock
 
   useEffect(() => {
     const untilChange = msUntilSavedTokenExpiryLabelChanges(new Date(expiresAtMs), now)
     if (untilChange === null) return
-    const timer = setTimeout(() => setNow(Date.now()), untilChange)
+    const timer = setTimeout(
+      () => setClock((current) => ({ ...current, now: Date.now() })),
+      untilChange
+    )
     return () => clearTimeout(timer)
   }, [expiresAtMs, now])
 

apps/sim/lib/credentials/token-service-accounts/validators/github.test.ts

@@ -109,6 +109,8 @@ describe('GitHub saved personal access token verification', () => {
       ['a zone name other than UTC', '2026-12-01 10:30:00 PST'],
       ['a lowercase utc marker', '2026-12-01 10:30:00 utc'],
       ['an impossible date', '2026-13-45 10:00:00 +0000'],
+      ['an offset hour past 23', '2026-12-01 10:30:00 +2400'],
+      ['an offset minute past 59', '2026-12-01 10:30:00 -0060'],
       ['an expiry in the past, contradicting the accepted request', '2026-11-10 12:00:00 +0000'],
     ])('records no expiry for %s and still accepts the token', async (_, header) => {
       fetch.mockResolvedValue(userReply(header))

apps/sim/lib/credentials/vendor-token-expiry.ts

@@ -30,9 +30,10 @@ function calendarMomentUtc(
  * `2026-12-01 12:30:00 +0200` or `2026-12-01 10:30:00 UTC`. GitHub documents the header but not
  * its value format, so this is parsed strictly by design: the two forms accepted are the ones in
  * the API responses GitHub's own client library records (octokit/octokit.rb spec cassettes), and
- * any other form is left unread.
+ * any other form (including an offset past 23 hours or 59 minutes) is left unread.
  */
-const GITHUB_TOKEN_EXPIRATION = /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2}) ([+-]\d{4}|UTC)$/
+const GITHUB_TOKEN_EXPIRATION =
+  /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2}) ([+-](?:[01]\d|2[0-3])[0-5]\d|UTC)$/
 
 /**
  * Reads GitHub's `GitHub-Authentication-Token-Expiration` response header, which GitHub sends on