Add 6 month default and max MCP token expiry by Copilot · Pull Request #1043 · IntelliTect/EssentialCSharp.Web

Copilot · 2026-04-29T16:10:44Z

Inspect MCP token creation flow and current expiry behavior
Run existing tests to capture baseline issues
Add shared 6-month default and maximum MCP token expiration enforcement
Update MCP API and account management UI messaging/validation to reflect the 6-month default and max
Add or update tests covering default and maximum MCP token expiration behavior
Run targeted validation for the affected projects
Run final review/security validation and open a PR

Agent-Logs-Url: https://github.com/IntelliTect/EssentialCSharp.Web/sessions/29b86c94-db59-4104-8285-197ae2428813 Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>

Copilot

Pull request overview

Enforces a 6-month default and maximum expiration window for MCP API tokens across the service layer, API endpoint, and account management UI.

Changes:

Added shared default/max expiry logic to McpApiTokenService and applied it during token creation.
Updated MCP token creation validation/messaging in both the API controller and Identity management UI.
Added integration tests covering default expiry, custom expiry within bounds, and rejection beyond the max.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
EssentialCSharp.Web/Views/McpSetup/Index.cshtml	Updates setup guide wording to reflect the new default expiry behavior.
EssentialCSharp.Web/Services/McpApiTokenService.cs	Centralizes 6-month default/max expiry calculation and enforces it in `CreateTokenAsync`.
EssentialCSharp.Web/Controllers/McpTokenController.cs	Adds max-expiry validation for the API token creation endpoint.
EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/McpAccess.cshtml.cs	Adds server-side expiry bounds/defaulting and validation in the account management flow.
EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/McpAccess.cshtml	Updates UI constraints (`max` attribute) and messaging for the new expiry rules.
EssentialCSharp.Web.Tests/McpApiTokenServiceTests.cs	Adds tests for default expiry, valid custom expiry, and max-expiry enforcement.

Copilot · 2026-04-29T18:55:13Z

+        DateTime requestedExpiry = McpApiTokenService.GetDefaultExpirationUtc(DateTime.UtcNow).AddDays(1);
+
+        await Assert.That(() => tokenService.CreateTokenAsync(userId, "too-long", requestedExpiry))
+            .Throws<ArgumentOutOfRangeException>()
+            .WithMessageContaining("6 months");


This test can be flaky around a UTC midnight boundary: requestedExpiry is computed from DateTime.UtcNow, but CreateTokenAsync computes createdAt from a separate UtcNow. If the date rolls over between those calls, the service's computed max can advance by a day and the requestedExpiry may no longer be beyond the max, causing intermittent failures. Consider making requestedExpiry unambiguously beyond any possible max (e.g., more than 1 day past), or refactoring token creation to accept/inject a reference time so tests can be deterministic.

Copilot · 2026-04-29T18:55:14Z

 public class McpApiTokenService(EssentialCSharpWebContext db)
 {
+    public const int DefaultLifetimeMonths = 6;
+    public const string MaxExpiryValidationMessage = "MCP tokens can expire at most 6 months from today.";


MaxExpiryValidationMessage hard-codes "6 months" while DefaultLifetimeMonths is the actual source of truth. If the lifetime ever changes, the validation message (and any consumers that display it) will become inaccurate; consider formatting the message from DefaultLifetimeMonths (and optionally include the computed max date for clarity).

Suggested change

public const string MaxExpiryValidationMessage = "MCP tokens can expire at most 6 months from today.";

public static string MaxExpiryValidationMessage => $"MCP tokens can expire at most {DefaultLifetimeMonths} months from today.";

Copilot · 2026-04-29T18:55:14Z

        DateTime? expiresAt = null;
+        DateOnly maxExpiresOn = McpApiTokenService.GetDefaultExpiryDate();
        if (request?.ExpiresOn is DateOnly expiresOn)
        {
            if (expiresOn < DateOnly.FromDateTime(DateTime.UtcNow))


DateTime.UtcNow is evaluated multiple times during validation (GetDefaultExpiryDate() and the expiresOn < DateOnly.FromDateTime(DateTime.UtcNow) check). If the request crosses a UTC midnight boundary between calls, the computed maxExpiresOn and "today" could disagree, causing inconsistent accept/reject behavior. Capture a single nowUtc at the top of the action and derive both bounds from it (you can pass it into GetDefaultExpiryDate(nowUtc)).

Suggested change

DateTime? expiresAt = null;

DateOnly maxExpiresOn = McpApiTokenService.GetDefaultExpiryDate();

if (request?.ExpiresOn is DateOnly expiresOn)

{

if (expiresOn < DateOnly.FromDateTime(DateTime.UtcNow))

DateTime nowUtc = DateTime.UtcNow;

DateOnly todayUtc = DateOnly.FromDateTime(nowUtc);

DateTime? expiresAt = null;

DateOnly maxExpiresOn = McpApiTokenService.GetDefaultExpiryDate(nowUtc);

if (request?.ExpiresOn is DateOnly expiresOn)

{

if (expiresOn < todayUtc)

Copilot · 2026-04-29T18:55:15Z

        DisableCaching();
+        InitializeExpiryBounds();
+        ApplyDefaultExpiryIfMissing();
        string? userId = userManager.GetUserId(User);
        if (userId is null) return Challenge();

        if (string.IsNullOrWhiteSpace(TokenName))
            ModelState.AddModelError(nameof(TokenName), "Token name is required.");

-        if (ExpiresOn.HasValue && ExpiresOn.Value < DateOnly.FromDateTime(DateTime.UtcNow))
-            ModelState.AddModelError(nameof(ExpiresOn), "Expiry date must be today or in the future.");
+        if (ExpiresOn.HasValue)
+        {
+            if (ExpiresOn.Value < DateOnly.FromDateTime(DateTime.UtcNow))
+                ModelState.AddModelError(nameof(ExpiresOn), "Expiry date must be today or in the future.");
+            if (ExpiresOn.Value > MaxExpiresOn)
+                ModelState.AddModelError(nameof(ExpiresOn), McpApiTokenService.MaxExpiryValidationMessage);


InitializeExpiryBounds() (via GetDefaultExpiryDate()) and the "today" check each call DateTime.UtcNow separately. Around a UTC date rollover, this can yield inconsistent validation (e.g., MaxExpiresOn computed from one day but the comparison uses the next day). Capture a single nowUtc per request and use it for both MaxExpiresOn and the minimum-date validation (e.g., DateOnly.FromDateTime(nowUtc)).

Copilot · 2026-04-29T18:55:15Z

+                    <input asp-for="ExpiresOn" type="date" class="form-control" max="@Model.MaxExpiresOn.ToString("yyyy-MM-dd")" />
                    <span asp-validation-for="ExpiresOn" class="text-danger"></span>
-                    <div class="form-text">Leave blank for a non-expiring token. The token expires at end of day (23:59:59) UTC on the selected date.</div>
+                    <div class="form-text">MCP tokens default to 6 months and cannot exceed 6 months from today. The token expires at end of day (23:59:59) UTC on the selected date.</div>


The help text says the token expires at end of day "(23:59:59) UTC", but the code persists TimeOnly.MaxValue (23:59:59.9999999). To avoid inaccurate UX/docs, consider changing the text to just "end of day (UTC)" or align it with the actual persisted precision.

Suggested change

<div class="form-text">MCP tokens default to 6 months and cannot exceed 6 months from today. The token expires at end of day (23:59:59) UTC on the selected date.</div>

<div class="form-text">MCP tokens default to 6 months and cannot exceed 6 months from today. The token expires at end of day (UTC) on the selected date.</div>

Copilot AI and others added 3 commits April 29, 2026 16:02

Add 6 month MCP token expiry defaults

9a39d05

Agent-Logs-Url: https://github.com/IntelliTect/EssentialCSharp.Web/sessions/29b86c94-db59-4104-8285-197ae2428813 Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>

Refine MCP token expiry enforcement

c42156a

Agent-Logs-Url: https://github.com/IntelliTect/EssentialCSharp.Web/sessions/29b86c94-db59-4104-8285-197ae2428813 Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>

Tighten MCP expiry tests and page model flow

68eb37b

Agent-Logs-Url: https://github.com/IntelliTect/EssentialCSharp.Web/sessions/29b86c94-db59-4104-8285-197ae2428813 Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>

Copilot AI assigned Copilot and BenjaminMichaelis Apr 29, 2026

Copilot created this pull request from a session on behalf of BenjaminMichaelis April 29, 2026 16:11 View session

Copilot AI requested a review from BenjaminMichaelis April 29, 2026 16:11

Copilot finished work on behalf of BenjaminMichaelis April 29, 2026 16:11

Copilot started work on behalf of BenjaminMichaelis April 29, 2026 16:28 View session

Copilot finished work on behalf of BenjaminMichaelis April 29, 2026 16:32

Copilot started work on behalf of BenjaminMichaelis April 29, 2026 16:34 View session

Copilot finished work on behalf of BenjaminMichaelis April 29, 2026 16:37

BenjaminMichaelis marked this pull request as ready for review April 29, 2026 18:50

Copilot AI review requested due to automatic review settings April 29, 2026 18:50

Copilot started reviewing on behalf of BenjaminMichaelis April 29, 2026 18:51 View session

Copilot AI reviewed Apr 29, 2026

View reviewed changes

BenjaminMichaelis merged commit 2d3ffbe into main Apr 30, 2026
13 checks passed

BenjaminMichaelis deleted the copilot/add-default-max-mcp-token-expiration branch April 30, 2026 07:14

Copilot AI mentioned this pull request Apr 30, 2026

Fix follow-up MCP token review feedback #1044

Open

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add 6 month default and max MCP token expiry#1043

Add 6 month default and max MCP token expiry#1043
BenjaminMichaelis merged 3 commits intomainfrom
copilot/add-default-max-mcp-token-expiration

Copilot AI commented Apr 29, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Copilot AI Apr 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	public const string MaxExpiryValidationMessage = "MCP tokens can expire at most 6 months from today.";
	public static string MaxExpiryValidationMessage => $"MCP tokens can expire at most {DefaultLifetimeMonths} months from today.";

	<div class="form-text">MCP tokens default to 6 months and cannot exceed 6 months from today. The token expires at end of day (23:59:59) UTC on the selected date.</div>
	<div class="form-text">MCP tokens default to 6 months and cannot exceed 6 months from today. The token expires at end of day (UTC) on the selected date.</div>

Conversation

Copilot AI commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 29, 2026 •

edited

Loading