Usability Issues on Personal Access Tokens GUI
Summary
The Personal Access Tokens page gives ambiguous messaging around when a token expires or was created, and is misleading on the lifecycle of newly or previously created tokens. Here is a collection of usability issues I see on the page:
- I can create a token that is already expired using the calendar picker to pick the current day. The calendar picker lets me pick the current day. If I select it, the token will be inactive already. I assume this is because the tokens expire at midnight of the selected day? Hard to tell, see item 3.
- I can create a token that is already expired using the calendar picker to pick tomorrow. The calendar picker lets me pick tomorrow. If I select it, sometimes the token will be inactive. I assume this is because I am in the PDT timezone (UTC -7 hours), and tokens expire at midnight UTC of the selected day? Again, hard to tell, see item 3.
- I cannot tell when my tokens will expire Right now it says a date. No time. No timezone. Based upon the behavior I'm seeing, I assume it expires at midnight UTC?
- I can create a token today that says I created it tomorrow Sometimes, the token I create today will say it was created tomorrow. I assume this is because I am in the PDT timezone (UTC -7 hours), and that any token I create after 5pm in my time is tomorrow in UTC.
- If you have inactive tokens, the message for active tokens says "You don't have any active tokens yet.". This is wrong. I have had active tokens. I do not presently, but the use of the adverb "yet" is anachronistic.
Steps to reproduce
Except for item (5), these all seem specific to timezones. So, for context, I will give instructions with the assumption that you have set your user profiles to PDT.
- On the Personal Access Tokens page, create a token by giving it any name and selecting the current date from the "Expires at" date picker. Click "Create Personal Access Token."
- After 5pm in PDT, on the Personal Access Tokens page, create a token by giving it any name and selecting tomorrow from the "Expires at" date picker. Click "Create Personal Access Token."
- On the Personal Access Tokens page, create a token that expires at least 2 days from now. That will ensure it is active right now regardless of your timezone.
- After 5pm in PDT, on the Personal Access Tokens page, create a Personal Access Token. It does not matter if you create one that results in an active or inactive token.
- On the Personal Access Tokens page, create a Personal Access Token that expires at least 2 days from now. After the page refreshes, click "Revoke."
Expected behavior
- I cannot select a date that would render the token inactive immediately.
- I cannot select a date that would render the token inactive immediately.
- The token appears under "Active Personal Access Tokens", but under "Expires" there is a localized relative timestamp, rounded down, telling me for how much longer my private access token will be active.
- In both "Active Personal Access Tokens" and "Inactive Personal Access Tokens", the created timestamp is a localized relative timestamp, not a date in UTC.
- The message under "Active Personal Access Tokens" reads "You do not have any active tokens."
Actual behavior
- Upon clicking "Create Personal Access Token", the token appears immediately under "Inactive Personal Access Tokens"
- Upon clicking "Create Personal Access Token", the token appears immediately under "Inactive Personal Access Tokens"
- The token appears under "Active Personal Access Tokens". A date appears under "Expires", with no context of timezone nor time.
- Tomorrow appears under the "Created" header for the token (regardless of whether it is in the "Active Personal Access Tokens" or "Inactive Personal Access Tokens").
- The message under "Active Personal Access Tokens" reads "You don't have any active tokens yet."
Relevant logs and/or screenshots
Results of GitLab environment info
I am in the PDT timezone. Item (2) may not be a problem for those who are in a timezone that is ahead of UTC.
Edited by 🤖 GitLab Bot 🤖
