🪲 [Fix]: Fix an issue with all App/JWT tokens being marked as expired (#497)

MariusStorhaug · web-flow · commit 4bf12ffa34f3 · 2025-09-05T19:31:02.000+02:00
## Description This pull request updates the handling of JWT token issue and expiry times, ensuring consistent use of local time and simplifying the calculation of token expiry intervals. The changes improve time zone handling and streamline the logic for determining token validity. **Improvements to JWT Time Handling:** * Changed the calculation of `IssuedAt` and `ExpiresAt` in `New-GitHubUnsignedJWT.ps1` to use `LocalDateTime` instead of `DateTime`, ensuring the times are always in local time. * In `Update-GitHubAppJWT.ps1`, added logic to convert `ExpiresAt` from UTC to local time if needed before updating the context, further standardizing time zone usage. **Simplification of Token Expiry Calculation:** * Simplified the `TokenExpiresIn` and `RefreshTokenExpiresIn` script properties in `GitHubContext.Types.ps1xml` by removing redundant checks for negative intervals and directly returning the time difference. ## Type of change  - [ ] 📖 [Docs] - [x] 🪲 [Fix] - [ ] 🩹 [Patch] - [ ] ⚠️ [Security fix] - [ ] 🚀 [Feature] - [ ] 🌟 [Breaking change] ## Checklist  - [x] I have performed a self-review of my own code - [x] I have commented my code, particularly in hard-to-understand areas
diff --git a/src/functions/private/Apps/GitHub Apps/New-GitHubUnsignedJWT.ps1 b/src/functions/private/Apps/GitHub Apps/New-GitHubUnsignedJWT.ps1
@@ -44,9 +44,9 @@
                 typ = 'JWT'
             }
         )
-        $now = [System.DateTimeOffset]::UtcNow
-        $iat = $now.AddMinutes(-10)
-        $exp = $now.AddMinutes(10)
+        $nowUtc = [System.DateTimeOffset]::UtcNow
+        $iat = $nowUtc.AddMinutes(-10)
+        $exp = $nowUtc.AddMinutes(10)
         $payload = [GitHubJWTComponent]::ToBase64UrlString(
             @{
                 iat = $iat.ToUnixTimeSeconds()
@@ -56,8 +56,8 @@
         )
         [pscustomobject]@{
             Base      = "$header.$payload"
-            IssuedAt  = $iat.DateTime
-            ExpiresAt = $exp.DateTime
+            IssuedAt  = $iat.LocalDateTime
+            ExpiresAt = $exp.LocalDateTime
             Issuer    = $ClientID
         }
     }
diff --git a/src/functions/private/Apps/GitHub Apps/Update-GitHubAppJWT.ps1 b/src/functions/private/Apps/GitHub Apps/Update-GitHubAppJWT.ps1
@@ -92,7 +92,11 @@
                             throw 'No Private Key or KeyVault Key Reference provided in the context.'
                         }
 
-                        $Context.TokenExpiresAt = $unsignedJWT.ExpiresAt
+                        $expiresAt = $unsignedJWT.ExpiresAt
+                        if ($expiresAt.Kind -eq [DateTimeKind]::Utc) {
+                            $expiresAt = $expiresAt.ToLocalTime()
+                        }
+                        $Context.TokenExpiresAt = $expiresAt
 
                         if ($Context.ID) {
                             if ($PSCmdlet.ShouldProcess('JWT token', 'Update/refresh')) {
@@ -122,7 +126,6 @@
                 }
             }
         } else {
-            # JWT is still valid, no refresh needed
             Write-Debug 'JWT is still valid, no refresh needed'
         }
 
diff --git a/src/types/GitHubContext.Types.ps1xml b/src/types/GitHubContext.Types.ps1xml
@@ -7,22 +7,14 @@
                 <Name>TokenExpiresIn</Name>
                 <GetScriptBlock>
                     if ($null -eq $this.TokenExpiresAt) { return [TimeSpan]::Zero }
-                    $timeRemaining = $this.TokenExpiresAt - [DateTime]::Now
-                    if ($timeRemaining.TotalSeconds -lt 0) {
-                    return [TimeSpan]::Zero
-                    }
-                    return $timeRemaining
+                    $this.TokenExpiresAt - [DateTime]::Now
                 </GetScriptBlock>
             </ScriptProperty>
             <ScriptProperty>
                 <Name>RefreshTokenExpiresIn</Name>
                 <GetScriptBlock>
                     if ($null -eq $this.RefreshTokenExpiresAt) { return [TimeSpan]::Zero }
-                    $timeRemaining = $this.RefreshTokenExpiresAt - [DateTime]::Now
-                    if ($timeRemaining.TotalSeconds -lt 0) {
-                    return [TimeSpan]::Zero
-                    }
-                    return $timeRemaining
+                    $this.RefreshTokenExpiresAt - [DateTime]::Now
                 </GetScriptBlock>
             </ScriptProperty>
         </Members>
@@ -34,11 +26,7 @@
                 <Name>TokenExpiresIn</Name>
                 <GetScriptBlock>
                     if ($null -eq $this.TokenExpiresAt) { return [TimeSpan]::Zero }
-                    $timeRemaining = $this.TokenExpiresAt - [DateTime]::Now
-                    if ($timeRemaining.TotalSeconds -lt 0) {
-                    return [TimeSpan]::Zero
-                    }
-                    return $timeRemaining
+                    $this.TokenExpiresAt - [DateTime]::Now
                 </GetScriptBlock>
             </ScriptProperty>
         </Members>
@@ -50,11 +38,7 @@
                 <Name>TokenExpiresIn</Name>
                 <GetScriptBlock>
                     if ($null -eq $this.TokenExpiresAt) { return }
-                    $timeRemaining = $this.TokenExpiresAt - [DateTime]::Now
-                    if ($timeRemaining.TotalSeconds -lt 0) {
-                    return [TimeSpan]::Zero
-                    }
-                    return $timeRemaining
+                    $this.TokenExpiresAt - [DateTime]::Now
                 </GetScriptBlock>
             </ScriptProperty>
         </Members>

Original file line number	Diff line number	Diff line change
`@@ -44,9 +44,9 @@`
`44`	`44`	`typ = 'JWT'`
`45`	`45`	`}`
`46`	`46`	`)`
`47`		`- $now = [System.DateTimeOffset]::UtcNow`
`48`		`- $iat = $now.AddMinutes(-10)`
`49`		`- $exp = $now.AddMinutes(10)`
	`47`	`+ $nowUtc = [System.DateTimeOffset]::UtcNow`
	`48`	`+ $iat = $nowUtc.AddMinutes(-10)`
	`49`	`+ $exp = $nowUtc.AddMinutes(10)`
`50`	`50`	`$payload = [GitHubJWTComponent]::ToBase64UrlString(`
`51`	`51`	`@{`
`52`	`52`	`iat = $iat.ToUnixTimeSeconds()`
`@@ -56,8 +56,8 @@`
`56`	`56`	`)`
`57`	`57`	`[pscustomobject]@{`
`58`	`58`	`Base = "$header.$payload"`
`59`		`- IssuedAt = $iat.DateTime`
`60`		`- ExpiresAt = $exp.DateTime`
	`59`	`+ IssuedAt = $iat.LocalDateTime`
	`60`	`+ ExpiresAt = $exp.LocalDateTime`
`61`	`61`	`Issuer = $ClientID`
`62`	`62`	`}`
`63`	`63`	`}`
Original file line number	Diff line number	Diff line change
`@@ -92,7 +92,11 @@`
`92`	`92`	`throw 'No Private Key or KeyVault Key Reference provided in the context.'`
`93`	`93`	`}`
`94`	`94`
`95`		`- $Context.TokenExpiresAt = $unsignedJWT.ExpiresAt`
	`95`	`+ $expiresAt = $unsignedJWT.ExpiresAt`
	`96`	`+ if ($expiresAt.Kind -eq [DateTimeKind]::Utc) {`
	`97`	`+ $expiresAt = $expiresAt.ToLocalTime()`
	`98`	`+ }`
	`99`	`+ $Context.TokenExpiresAt = $expiresAt`
`96`	`100`
`97`	`101`	`if ($Context.ID) {`
`98`	`102`	`if ($PSCmdlet.ShouldProcess('JWT token', 'Update/refresh')) {`
`@@ -122,7 +126,6 @@`
`122`	`126`	`}`
`123`	`127`	`}`
`124`	`128`	`} else {`
`125`		`- # JWT is still valid, no refresh needed`
`126`	`129`	`Write-Debug 'JWT is still valid, no refresh needed'`
`127`	`130`	`}`
`128`	`131`