🐛 Bugfix: Why did the extension show 'Signed in' with an expired JWT, ...

Date: 2026-03-31
Time: 12:00:46 UTC
Session: gspace1-290.21
Agent: angular
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

Why did the extension show 'Signed in' with an expired JWT, then fail with 401 on every API call?

Task: Fix misleading auth status in extension Config tab

🎯 Decision Made

Chosen:

Added isJwtExpired() to ConfigService that decodes JWT payload and checks exp claim. isAuthenticated now returns false when JWT is expired. Config tab shows 'Token expired — sign in again' with amber indicator.

Options Considered:

1. Decode JWT client-side and check exp (chosen)
2. Validate JWT by calling a backend /verify endpoint
3. Only check expiry when an API call fails with 401

💭 Reasoning

Root cause: isAuthenticated() in mcp-client.service.ts only checked if a JWT STRING existed (!!config.hasJwtAuth()), never decoded it to validate the exp claim. The user's JWT expired 10 hours prior (exp: 2026-03-31T01:20:11Z). Every API call sent the dead token → 401. The UI was misleading because it showed green 'Signed in' status. This is a class of bug where presence-check != validity-check. The fix decodes the JWT payload (base64url), reads exp, compares to Date.now()/1000. No crypto verification needed — we're checking expiry, not signature.

📁 Files Involved

• apps/vitto-vscode-extension/src/services/config.service.ts
• apps/vitto-vscode-extension/src/panels/main-panel.ts
• apps/vitto-vscode-extension/src/panels/webview/components/settings/settings-view.ts
• apps/vitto-vscode-extension/src/panels/webview/types.ts

🔗 Related

• Decision ID: dev_1774958446683_1enpzs0
• Session: 290
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation