Settings.api.token_ttl Ignored at Runtime

[jbarson47]

Summary

A region- or server-level override of Settings.api.token_ttl is not honored at runtime, even when ::Settings.api.token_ttl clearly reflects the new value in the same Ruby process. As a result, /api/auth continues to issue tokens with the YAML default TTL (10.minutes / 600s) for the lifetime of the worker process even after updating relevant settings to 60.minutes - regardless of SettingsChange records, Vmdb::Settings.reload!, or systemctl restart evmserverd.

Reproduced on a production Radjabov MIQ deployment.

Empirical reproduction

Override api/token_ttl to 60.minutes at both region and server scope (Application Settings → Configuration → Advanced), then run rails c on a UI/API node that has been restarted after the override was saved:

# 1) The live TokenManager closure that gen_token actually uses:
mgr = Api::Environment.user_token_service.token_mgr('api')
puts "lambda ttl = #{mgr.instance_variable_get(:@options)[:token_ttl].call}"
# => lambda ttl = 600

# 2) The api_config snapshot the closure was built from:
svc = Api::Environment.user_token_service
puts "cached api_config token_ttl = #{svc.send(:api_config)[:token_ttl].inspect}"
# => cached api_config token_ttl = "10.minutes"

# 3) What ::Settings actually says, right now, in the same process:
puts "live Settings.api.token_ttl = #{Settings.api.token_ttl.inspect}"
puts "live to_i_with_method        = #{Settings.api.token_ttl.to_i_with_method}"
# => live Settings.api.token_ttl = "60.minutes"
# => live to_i_with_method        = 3600

# 4) The override is correctly persisted at both scopes:
SettingsChange.where(:key => '/api/token_ttl').pluck(:resource_type, :resource_id, :value)
# => [["MiqServer", <id>, "60.minutes"], ["MiqRegion", 1, "60.minutes"]]

The HTTP API confirms the same TTL the cached lambda reports:

$ curl -sk -u 'user:pass' https://<host>/api/auth
{"auth_token":"...","token_ttl":600,"expires_on":"..."}

A clean systemctl restart evmserverd does not change this — the response is still "token_ttl":600 after the restart, even though SettingsChange is in place from before the restart and Settings.api.token_ttl reads as "60.minutes" immediately after boot.

Workaround

Vmdb::Settings.local_sources picks up <vmdb>/config/settings.local.yml as part of the YAML load, before any DB merge. Setting the YAML default itself sidesteps the cache-staleness problem entirely. On each UI/API appliance, drop:

# /var/www/miq/vmdb/config/settings.local.yml
:api:
  :token_ttl: 60.minutes

…then restart evmserverd. We've confirmed empirically that this restores "token_ttl":3600 from /api/auth on the same appliance where settings updates -> evmserverd restarts alone did not.