| 1 | -- Token expiry and last use. |
| 2 | -- |
| 3 | -- Both nullable, and both null for every token issued before this ran: an existing |
| 4 | -- token keeps working forever, because retroactively expiring a credential someone |
| 5 | -- pasted into a machine months ago would break a clone with no warning and no way to |
| 6 | -- connect the failure to an upgrade. New tokens get an expiry from the issue form. |
| 7 | -- |
| 8 | -- `last_used_at` is written at most once a minute per token (see |
| 9 | -- `PersonalAccessToken::USE_RESOLUTION`), so authentication stays a read for all but |
| 10 | -- the first request of any given minute. It is display only — nothing authorizes on it. |
| 11 | tokens add column expires_at integer; |
| 12 | tokens add column last_used_at integer; |