Is your feature request related to a problem?
Yes. If a user revokes DevTrack's access from GitHub (Settings → Applications → Revoke), their session inside DevTrack stays fully active for up to 30 days (current JWT maxAge). During this time, every API call silently fails and the dashboard shows empty widgets with no error message — the user has no idea why their data disappeared. It looks like a bug in the app, not a revoked token.
Describe the solution you'd like
On each session update cycle, make a single lightweight call to GET https://api.github.com/user using the stored access token. If GitHub returns a 401, immediately invalidate the JWT session and redirect the user to /auth/signin with a clear message:
"Your GitHub access was revoked. Please sign in again to continue."
This requires a small change in:
src/lib/auth.ts — add token validation inside the jwt callback on session refresh
src/app/auth/signin/page.tsx — display the revocation message when redirected with an error param
Describe alternatives you've considered
Reducing maxAge from 30 days to 1–7 days — this limits the exposure window but doesn't give the user any feedback about what went wrong.
Additional context
The jwt callback in src/lib/auth.ts currently returns the token as-is on every refresh with no validation against GitHub
The fix adds only one extra API call per session refresh (GET /user costs 1 out of 5000 REST req/hr — negligible)
This is different from issue #858 (CSP/XSS) — this is purely about auth lifecycle and user feedback
I am a GSSoC '26 contributor and would love to work on this if assigned!
Is your feature request related to a problem?
Yes. If a user revokes DevTrack's access from GitHub (Settings → Applications → Revoke), their session inside DevTrack stays fully active for up to 30 days (current JWT maxAge). During this time, every API call silently fails and the dashboard shows empty widgets with no error message — the user has no idea why their data disappeared. It looks like a bug in the app, not a revoked token.
Describe the solution you'd like
On each session update cycle, make a single lightweight call to GET https://api.github.com/user using the stored access token. If GitHub returns a 401, immediately invalidate the JWT session and redirect the user to /auth/signin with a clear message:
"Your GitHub access was revoked. Please sign in again to continue."
This requires a small change in:
src/lib/auth.ts — add token validation inside the jwt callback on session refresh
src/app/auth/signin/page.tsx — display the revocation message when redirected with an error param
Describe alternatives you've considered
Reducing maxAge from 30 days to 1–7 days — this limits the exposure window but doesn't give the user any feedback about what went wrong.
Additional context
The jwt callback in src/lib/auth.ts currently returns the token as-is on every refresh with no validation against GitHub
The fix adds only one extra API call per session refresh (GET /user costs 1 out of 5000 REST req/hr — negligible)
This is different from issue #858 (CSP/XSS) — this is purely about auth lifecycle and user feedback
I am a GSSoC '26 contributor and would love to work on this if assigned!