fix(webapp): deployment log stream tokens headroom over their cache TTL

Mono-RevId: b622cd7f35e8a2de16f6b305192fe2bccb7d1de9

Author: myftija

.server-changes/fix-deploy-log-stream-token-expiry.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Fixes an intermittent "Invalid access token" failure caused by the deployment log stream token expiring while a deploy was still in flight.

apps/webapp/app/env.server.ts

@@ -73,17 +73,37 @@ const S2EnvSchema = z.preprocess(
     }
     return obj;
   },
-  z.discriminatedUnion("S2_ENABLED", [
-    z.object({
-      S2_ENABLED: z.literal("1"),
-      S2_ACCESS_TOKEN: z.string(),
-      S2_DEPLOYMENT_LOGS_BASIN_NAME: z.string(),
-      S2_DEPLOYMENT_STREAMS_LOCAL: z.string().default("0"),
-    }),
-    z.object({
-      S2_ENABLED: z.literal("0"),
-    }),
-  ])
+  z
+    .discriminatedUnion("S2_ENABLED", [
+      z.object({
+        S2_ENABLED: z.literal("1"),
+        S2_ACCESS_TOKEN: z.string(),
+        S2_DEPLOYMENT_LOGS_BASIN_NAME: z.string(),
+        S2_DEPLOYMENT_STREAMS_LOCAL: z.string().default("0"),
+        S2_DEPLOYMENT_LOGS_TOKEN_VALIDITY_MS: z.coerce
+          .number()
+          .int()
+          .min(60 * 1000)
+          .default(60 * 60 * 1000),
+        S2_DEPLOYMENT_LOGS_TOKEN_CACHE_TTL_MS: z.coerce
+          .number()
+          .int()
+          .min(1000)
+          .default(30 * 60 * 1000),
+      }),
+      z.object({
+        S2_ENABLED: z.literal("0"),
+      }),
+    ])
+    .refine(
+      (val) =>
+        val.S2_ENABLED !== "1" ||
+        val.S2_DEPLOYMENT_LOGS_TOKEN_CACHE_TTL_MS * 2 <= val.S2_DEPLOYMENT_LOGS_TOKEN_VALIDITY_MS,
+      {
+        path: ["S2_DEPLOYMENT_LOGS_TOKEN_CACHE_TTL_MS"],
+        message: "must be at most half of S2_DEPLOYMENT_LOGS_TOKEN_VALIDITY_MS",
+      }
+    )
 );
 
 // Previously published secret values must never be accepted, including when

apps/webapp/app/presenters/v3/DeploymentPresenter.server.ts

@@ -295,7 +295,7 @@ export class DeploymentPresenter {
 
     const { accessToken } = await s2.accessTokens.issue({
       id: `${projectRef}-${new Date().getTime()}`,
-      expiresAt: new Date(Date.now() + 60 * 60 * 1000), // 1 hour
+      expiresAt: new Date(Date.now() + env.S2_DEPLOYMENT_LOGS_TOKEN_VALIDITY_MS),
       scope: {
         ops: ["read"],
         basins: {
@@ -309,7 +309,7 @@ export class DeploymentPresenter {
 
     await s2TokenRedis.setex(
       redisKey,
-      59 * 60, // slightly shorter than the token validity period
+      Math.floor(env.S2_DEPLOYMENT_LOGS_TOKEN_CACHE_TTL_MS / 1000),
       accessToken
     );
 

apps/webapp/app/v3/services/deployment.server.ts

@@ -522,6 +522,8 @@ export class DeploymentService extends BaseService {
       return errAsync({ type: "s2_is_disabled" as const });
     }
     const basinName = env.S2_DEPLOYMENT_LOGS_BASIN_NAME;
+    const tokenValidityMs = env.S2_DEPLOYMENT_LOGS_TOKEN_VALIDITY_MS;
+    const cacheTtlSeconds = Math.floor(env.S2_DEPLOYMENT_LOGS_TOKEN_CACHE_TTL_MS / 1000);
     const redisKey = `${S2_TOKEN_KEY_PREFIX}${project.externalRef}`;
 
     const getTokenFromCache = () =>
@@ -539,7 +541,7 @@ export class DeploymentService extends BaseService {
       fromPromise(
         s2.accessTokens.issue({
           id: `${project.externalRef}-${new Date().getTime()}`,
-          expiresAt: new Date(Date.now() + 60 * 60 * 1000), // 1 hour
+          expiresAt: new Date(Date.now() + tokenValidityMs),
           scope: {
             ops: ["read"],
             basins: {
@@ -557,17 +559,10 @@ export class DeploymentService extends BaseService {
       ).map(({ accessToken }) => accessToken);
 
     const cacheToken = (token: string) =>
-      fromPromise(
-        s2TokenRedis.setex(
-          redisKey,
-          59 * 60, // slightly shorter than the token validity period
-          token
-        ),
-        (error) => ({
-          type: "other" as const,
-          cause: error,
-        })
-      );
+      fromPromise(s2TokenRedis.setex(redisKey, cacheTtlSeconds, token), (error) => ({
+        type: "other" as const,
+        cause: error,
+      }));
 
     return getTokenFromCache().orElse(() =>
       issueS2Token().andThen((token) =>