Admins now can easily do this with pagure-admin (the CLI tool).

We'll have to see if we want to adjust the UI or not for this.

+1 to the unlimited lifetime. Another annoying issue is that expired tokens are listed on the page and can't be removed. Since they're expired, why do they need to be listed?

Admins now can easily do this with pagure-admin (the CLI tool).

Admins of pagure or admins of git repo?

Admins of pagure or admins of git repo?

Admins of pagure

@pingou Is there a chance this could get adjusted in the near future? Fedora QA team wants to integrate https://qa.fedoraproject.org/blockerbugs/ with Pagure and create a new issue for each proposed blocker bug to serve as a discussion ticket. Having to create a new token every <60 days is tedious and error-prone. Can this get extended to e.g. a year (if infinite is out of question)? Btw, I looked at Github and they automatically remove tokens that haven't been used in a year.

What's adding to the tedium factor is that we of course want to limit the actions that can be done with that token. But the UI doesn't allow to "clone a token" that would have the same ACLs, just a new expiry date. The person needs to go through the permission list and manually select ones that apply, again creating the possibility for a human error.

Thanks for looking into this.

Couple of notes: you can ask the infra team to increase the lifetime of a token, that would be the easiest for now.

The more general issue about allowing people to set a lifetime for a token is: I have no idea what security experts recommend as being a good default and a good maximum.
If someone can provide this information, I'm happy to revise the code.

I looked at Github and they automatically remove tokens that haven't been used in a year.

That sounds like a nice idea, we don't track token usage at the moment so we would need to start with this to enable that.

But the UI doesn't allow to "clone a token" that would have the same ACLs, just a new expiry date.

This used to work, I guess it has been lost :(

Couple of notes: you can ask the infra team to increase the lifetime of a token, that would be the easiest for now.

Thanks, here it is:
https://pagure.io/fedora-infrastructure/issue/8520

I looked at Github and they automatically remove tokens that haven't been used in a year.

I also looked at GitLab and they simply ask you when it should expire. I created a 5-year token without issues.

Also, renewing tokens (that is, pushing out the expiration) should normally be a self-service option. Obviously one that generates an audit log event of some kind, but it's annoying that there's no way to do that.

The more general issue about allowing people to set a lifetime for a token is: I have no idea what security experts recommend as being a good default and a good maximum.
If someone can provide this information, I'm happy to revise the code.

I'm no security expert, but if you set the default lifetime (or make it configurable up) to a year, your policy as still at least as strict as Github's policy.

Commit bea040cb fixes this issue