feat: add refresh_token_duration and access_token_duration to workspace profile settings (#175)

d-bytebase · web-flow · commit b10665629224 · 2026-03-24T10:43:36.000+08:00
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-3.16.1
+3.16.2
diff --git a/docs/data-sources/setting.md b/docs/data-sources/setting.md
@@ -155,7 +155,9 @@ Optional:
 - `external_url` (String) The URL user visits Bytebase. The external URL is used for: 1. Constructing the correct callback URL when configuring the VCS provider. The callback URL points to the frontend; 2. Creating the correct webhook endpoint when configuring the project GitOps workflow. The webhook endpoint points to the backend.
 - `maximum_role_expiration_in_seconds` (Number) The max duration in seconds for role expired. If the value is less than or equal to 0, we will remove the setting. AKA no limit.
 - `password_restriction` (Block List, Max: 1) Password restriction settings. (see [below for nested schema](#nestedblock--workspace_profile--password_restriction))
+- `access_token_duration_in_seconds` (Number) The duration for access token in seconds. Default is 3600 (1 hour). The duration should be at least 60 (one minute).
 - `query_timeout_in_seconds` (Number) The maximum time allowed for a query to run in SQL Editor, in seconds. No limit when the value <= 0.
+- `refresh_token_duration_in_seconds` (Number) The duration for refresh token in seconds. Default is 604800 (7 days). The duration should be at least 3600 (one hour).
 - `sql_result_size` (Number) The size limit in bytes for SQL query results. The default value is 100MB.
 - `watermark` (Boolean) Whether to display watermark on pages. Requires ENTERPRISE license.
 
diff --git a/docs/resources/setting.md b/docs/resources/setting.md
@@ -215,7 +215,9 @@ Optional:
 - `external_url` (String) The URL user visits Bytebase. The external URL is used for: 1. Constructing the correct callback URL when configuring the VCS provider. The callback URL points to the frontend; 2. Creating the correct webhook endpoint when configuring the project GitOps workflow. The webhook endpoint points to the backend.
 - `maximum_role_expiration_in_seconds` (Number) The max duration in seconds for role expired. If the value is less than or equal to 0, we will remove the setting. AKA no limit.
 - `password_restriction` (Block List, Max: 1) Password restriction settings. (see [below for nested schema](#nestedblock--workspace_profile--password_restriction))
+- `access_token_duration_in_seconds` (Number) The duration for access token in seconds. Default is 3600 (1 hour). The duration should be at least 60 (one minute).
 - `query_timeout_in_seconds` (Number) The maximum time allowed for a query to run in SQL Editor, in seconds. No limit when the value <= 0.
+- `refresh_token_duration_in_seconds` (Number) The duration for refresh token in seconds. Default is 604800 (7 days). The duration should be at least 3600 (one hour).
 - `sql_result_size` (Number) The size limit in bytes for SQL query results. The default value is 100MB.
 - `watermark` (Boolean) Whether to display watermark on pages. Requires ENTERPRISE license.
 
diff --git a/examples/approval/main.tf b/examples/approval/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "terraform.local/bytebase/bytebase"
     }
diff --git a/examples/database/main.tf b/examples/database/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/database_group/main.tf b/examples/database_group/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/environments/main.tf b/examples/environments/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/groups/main.tf b/examples/groups/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/iamPolicy/main.tf b/examples/iamPolicy/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/instances/main.tf b/examples/instances/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/policies/main.tf b/examples/policies/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/projects/main.tf b/examples/projects/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/roles/main.tf b/examples/roles/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/settings/main.tf b/examples/settings/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/setup/main.tf b/examples/setup/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/sql_review/main.tf b/examples/sql_review/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/users/main.tf b/examples/users/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/provider/data_source_setting.go b/provider/data_source_setting.go
@@ -380,6 +380,18 @@ func getWorkspaceProfileSetting(computed bool) *schema.Schema {
 					Optional:    true,
 					Description: "The maximum time allowed for a query to run in SQL Editor, in seconds. No limit when the value <= 0.",
 				},
+				"refresh_token_duration_in_seconds": {
+					Type:         schema.TypeInt,
+					Optional:     true,
+					ValidateFunc: validation.IntAtLeast(3600),
+					Description:  "The duration for refresh token in seconds. Default is 604800 (7 days). The duration should be at least 3600 (one hour).",
+				},
+				"access_token_duration_in_seconds": {
+					Type:         schema.TypeInt,
+					Optional:     true,
+					ValidateFunc: validation.IntAtLeast(60),
+					Description:  "The duration for access token in seconds. Default is 3600 (1 hour). The duration should be at least 60 (one minute).",
+				},
 				"password_restriction": {
 					Type:        schema.TypeList,
 					Optional:    true,
@@ -692,6 +704,12 @@ func flattenWorkspaceProfileSetting(setting *v1pb.WorkspaceProfileSetting) []int
 	if v := setting.GetQueryTimeout(); v != nil {
 		raw["query_timeout_in_seconds"] = int(v.Seconds)
 	}
+	if v := setting.GetRefreshTokenDuration(); v != nil {
+		raw["refresh_token_duration_in_seconds"] = int(v.Seconds)
+	}
+	if v := setting.GetAccessTokenDuration(); v != nil {
+		raw["access_token_duration_in_seconds"] = int(v.Seconds)
+	}
 
 	// Handle password_restriction field
 	if v := setting.GetPasswordRestriction(); v != nil {
diff --git a/provider/resource_setting.go b/provider/resource_setting.go
@@ -228,6 +228,18 @@ func convertToV1WorkspaceProfileSetting(d *schema.ResourceData) (*v1pb.Workspace
 		}
 		updateMasks = append(updateMasks, "value.workspace_profile.query_timeout")
 	}
+	if config := workspaceRawConfig.GetAttr("refresh_token_duration_in_seconds"); !config.IsNull() {
+		workspacePrfile.RefreshTokenDuration = &durationpb.Duration{
+			Seconds: int64(raw["refresh_token_duration_in_seconds"].(int)),
+		}
+		updateMasks = append(updateMasks, "value.workspace_profile.refresh_token_duration")
+	}
+	if config := workspaceRawConfig.GetAttr("access_token_duration_in_seconds"); !config.IsNull() {
+		workspacePrfile.AccessTokenDuration = &durationpb.Duration{
+			Seconds: int64(raw["access_token_duration_in_seconds"].(int)),
+		}
+		updateMasks = append(updateMasks, "value.workspace_profile.access_token_duration")
+	}
 	if config := workspaceRawConfig.GetAttr("password_restriction"); !config.IsNull() {
 		if pwRestrictionList, ok := raw["password_restriction"].([]interface{}); ok && len(pwRestrictionList) > 0 {
 			pwRaw := pwRestrictionList[0].(map[string]interface{})
@@ -597,6 +609,8 @@ func resourceSettingDelete(ctx context.Context, d *schema.ResourceData, m interf
 			"value.workspace_profile.enable_audit_log_stdout",
 			"value.workspace_profile.sql_result_size",
 			"value.workspace_profile.query_timeout",
+			"value.workspace_profile.refresh_token_duration",
+			"value.workspace_profile.access_token_duration",
 		}
 	case v1pb.Setting_DATA_CLASSIFICATION:
 		setting.Value = &v1pb.SettingValue{
diff --git a/tutorials/0-provider.tf b/tutorials/0-provider.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.16.1"
+      version = "3.16.2"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }

Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`terraform {`
`2`	`2`	`required_providers {`
`3`	`3`	`bytebase = {`
`4`		`- version = "3.16.1"`
	`4`	`+ version = "3.16.2"`
`5`	`5`	`# For local development, please use "terraform.local/bytebase/bytebase" instead`
`6`	`6`	`source = "terraform.local/bytebase/bytebase"`
`7`	`7`	`}`
Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@`
`2`	`2`	`terraform {`
`3`	`3`	`required_providers {`
`4`	`4`	`bytebase = {`
`5`		`- version = "3.16.1"`
	`5`	`+ version = "3.16.2"`
`6`	`6`	`# For local development, please use "terraform.local/bytebase/bytebase" instead`
`7`	`7`	`source = "registry.terraform.io/bytebase/bytebase"`
`8`	`8`	`}`