A grant with an end date stays active past it when its expiration workflow fails to start or fails #261

New Issue

2026-10-24T06:51:54Z

cgalo5758 commented

2026-10-24 06:51:54 +00:00

What happens

An operator can give a grant an end date (valid_until) when issuing it or when extending it on an organization's enrollment page. The only thing that ends such a grant is GrantExpirationWorkflow (internal/workflows/entitlements/grant_expiration_workflow.go), which the request starts after the grant is committed (IssueGrant, and scheduleGrantExpiration for ManageGrant, in internal/server/operator_enrollment.go). Nothing else looks for active grants past their end: no Temporal schedule, no boot step, and no read of valid_until where entitlements are delivered.

So the grant keeps delivering after its end date when:

the workflow start fails (the Temporal call errors, or the request's context ends first). The page then says "Grant issued, but expiration scheduling FAILED; it will not auto-expire on its own. Retry, or revoke it manually.", and nothing records that the grant has no workflow;
the workflow starts, but ExpireGrantActivity fails on all five attempts that common.DefaultActivityOptions allows (about fifteen seconds of backoff in all). The workflow then fails and nothing retries it.

The enrollment page can tell that a marked grant is past its end with its expiry not yet run (will_not_resume in internal/entitlements/queries/grants.sql), but the grant stays active and the organization keeps what it conferred until an operator revokes it.

What should happen

Every active grant whose valid_until has passed is expired, whatever happened to its workflow. For example, a periodic sweep, set up beside the billing and domain claim sweeps in startSweepSchedules (cmd/start.go), expires each such grant through entitlements.ExpireGrantTx, the same act the workflow's activity runs.

Where

internal/server/operator_enrollment.go, internal/workflows/entitlements/grant_expiration_workflow.go

Steps

With the console connected to Temporal, open an organization's enrollment page.
Stop the test stack's temporal service, then issue a grant whose end date is a few minutes ahead. The grant is committed and the workflow start fails.
Start temporal again and wait past the end date: the grant is still Active and the organization still holds what it conferred.

Why it matters

An organization keeps a time-limited entitlement indefinitely after its end, and after the one banner nothing tells anyone.

### What happens An operator can give a grant an end date (`valid_until`) when issuing it or when extending it on an organization's enrollment page. The only thing that ends such a grant is `GrantExpirationWorkflow` (`internal/workflows/entitlements/grant_expiration_workflow.go`), which the request starts after the grant is committed (`IssueGrant`, and `scheduleGrantExpiration` for `ManageGrant`, in `internal/server/operator_enrollment.go`). Nothing else looks for active grants past their end: no Temporal schedule, no boot step, and no read of `valid_until` where entitlements are delivered. So the grant keeps delivering after its end date when: - the workflow start fails (the Temporal call errors, or the request's context ends first). The page then says "Grant issued, but expiration scheduling FAILED; it will not auto-expire on its own. Retry, or revoke it manually.", and nothing records that the grant has no workflow; - the workflow starts, but `ExpireGrantActivity` fails on all five attempts that `common.DefaultActivityOptions` allows (about fifteen seconds of backoff in all). The workflow then fails and nothing retries it. The enrollment page can tell that a marked grant is past its end with its expiry not yet run (`will_not_resume` in `internal/entitlements/queries/grants.sql`), but the grant stays `active` and the organization keeps what it conferred until an operator revokes it. ### What should happen Every active grant whose `valid_until` has passed is expired, whatever happened to its workflow. For example, a periodic sweep, set up beside the billing and domain claim sweeps in `startSweepSchedules` (`cmd/start.go`), expires each such grant through `entitlements.ExpireGrantTx`, the same act the workflow's activity runs. ### Where `internal/server/operator_enrollment.go`, `internal/workflows/entitlements/grant_expiration_workflow.go` ### Steps 1. With the console connected to Temporal, open an organization's enrollment page. 2. Stop the test stack's `temporal` service, then issue a grant whose end date is a few minutes ahead. The grant is committed and the workflow start fails. 3. Start `temporal` again and wait past the end date: the grant is still Active and the organization still holds what it conferred. ### Why it matters An organization keeps a time-limited entitlement indefinitely after its end, and after the one banner nothing tells anyone.

cgalo5758 added the

kind

bug

area/entitlements labels 2026-10-24 06:51:54 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#261