Repository navigation
fix(keys): validate expiry at SQL timestamp precision - #54
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Independent review of exact243442852aac717f7d6d836b93d8d8bf6e83f298: no blocking finding. The future-expiry check now compares at the SQL store's whole-second precision, after existing invalid-date validation and hashing, before storage. It preserves optional expiry for legacy scopes and introduces no minimum TTL. The real SqlApiKeyStore regression distinguishes an expiry within the already-current stored second from the next future stored second, with rejected-row and persisted-value checks. I independently ran both api-key-store-sql and api-keys tests under Node22.22.2; exit0. Receipt /tmp/gateway-expiry-precision-root-review.log. This validates serialization precision, not a guarantee against arbitrary storage latency consuming an intentionally near expiry. |
tangletools
left a comment
tangletools
left a comment
There was a problem hiding this comment.
Independent exact2434428 review receipt: #54 (comment). Checked SQL timestamp precision, preserved legacy optional expiry, absence of a new minimum TTL, and actual SQL persistence regression. Independent 60 issuer and SQL tests passed. No blocking finding.
A scoped key expiring within the current second could pass issuance, then become already expired when the SQL store rounded its timestamp. Compare required expiry at whole-second precision before storage. Optional legacy expiry remains unchanged.
Validation: actual SQL-store regression fails against the predecessor and passes after the fix; typecheck, all 524 tests and build pass. Regression checks both rejected subsecond expiry with no stored row and accepted next-second expiry that remains future after persistence.