READMD.md

Troubleshooting GitLab tokens

Modified from https://docs.gitlab.com/ee/security/tokens/token_troubleshooting.html#identify-dates-when-many-tokens-expire

1. In your terminal window, start a Rails console session with sudo gitlab-rails console.
2. Paste in the entire dates_when_most_of_tokens_expire.rb script.
3. Press Enter.

report_tokens.rb

expire_range = Date.today - 3.month .. Date.today + 1.month
acc = Gitlab::Access.options_with_none.inject(Hash.new([])) { |memo,(key,value)|
  memo[value] = key
  memo
}

# Check for expiring project and group access tokens
begin
  maps = PersonalAccessToken.project_access_token.where(expires_at: expire_range).group_by {|token| token.user.members.first.source }.to_a;0
  maps.sort_by! {|source, tokens| source.reference_link_text };0
  puts "| Source | Token Name | Created by | Created Date | Expire Date | Access Level | Scopes |"
  puts "|--------|------------|------------|--------------|-------------|--------------|--------|"
  maps.each do |source, tokens|
    tokens.each do |token|
      member = token.user.members.first
      access_level = acc[member.access_level]
      scopes = token.scopes.join(', ').gsub('read_repository', 'R_repo').gsub('write_repository', 'W_repo').gsub('read_registry', 'R_reg').gsub('write_registry', 'W_reg')
      puts "| #{source.reference_link_text} | #{token.name} | #{token.user.created_by.name} | #{token.created_at.to_date} | #{token.expires_at} | #{access_level} | #{scopes} |"
    end
  end
end; 0

# Check for personal access tokens
begin
  maps = PersonalAccessToken.owner_is_human.where(expires_at: expire_range).group_by(&:user).to_a;0
  maps.sort_by! {|user, tokens| user.email };0
  puts "| User | Token Name | Created Date | Expire Date | Scopes |"
  puts "|------|------------|--------------|-------------|--------|"
  maps.each do |user, tokens|
    tokens.each do |token|
      scopes = token.scopes.join(', ').gsub('read_repository', 'R_repo').gsub('write_repository', 'W_repo').gsub('read_registry', 'R_reg').gsub('write_registry', 'W_reg')
      puts "| #{user.email} | #{token.name} | #{token.created_at.to_date} | #{token.expires_at} | #{scopes} |"
    end
  end
end; 0