Reset API metadata on remote token sync

rvctl.py

@@ -789,6 +789,30 @@ def apply_authz_to_token(token_record: dict, authz: dict) -> bool:
     return changed
 
 
+def unknown_permission_map(fields: list[tuple[str, str]]) -> dict[str, str]:
+    return {short_name: "?" for short_name, _ in fields}
+
+
+def reset_token_api_metadata(token_record: dict) -> bool:
+    changed = False
+    if token_record.get("valid") != "?":
+        token_record["valid"] = "?"
+        changed = True
+    if token_record.pop("expires_at", None) is not None:
+        changed = True
+
+    for field_name, fields in [
+        ("scope", SCOPE_FIELDS),
+        ("org_perm", ORG_PERMISSION_FIELDS),
+        ("repo_perm", REPO_PERMISSION_FIELDS),
+    ]:
+        unknown_record = unknown_permission_map(fields)
+        if token_record.get(field_name) != unknown_record:
+            token_record[field_name] = unknown_record
+            changed = True
+    return changed
+
+
 def register_token(
     token_data: dict,
     server_info: dict,
@@ -796,6 +820,7 @@ def register_token(
     user_name: str,
     token_value: str,
     hydrate: bool = True,
+    reset_api_metadata: bool = False,
 ) -> str:
     endpoint = server_info["endpoint"]
     token_record = find_token_record(token_data, endpoint, remote_name)
@@ -827,6 +852,10 @@ def register_token(
                 token_record[target_name] = source_value
                 result = "updated"
 
+    if reset_api_metadata:
+        if reset_token_api_metadata(token_record) and result == "existing":
+            result = "updated"
+
     if hydrate:
         authz = load_gitea_authz(
             endpoint,
@@ -1027,7 +1056,15 @@ def sync_token_from_remote(config: WorkspaceConfig, repo_path: Path, remote_name
     result = "dry-run"
     if not dry_run:
         token_data = load_token_store(config)
-        result = register_token(token_data, server_info, remote_name, user_name, token_value, hydrate=False)
+        result = register_token(
+            token_data,
+            server_info,
+            remote_name,
+            user_name,
+            token_value,
+            hydrate=False,
+            reset_api_metadata=True,
+        )
         write_token_store(config, token_data)
 
     return {