From af7979e1ca0c40af2ba4a8d05edad6bb5796c584 Mon Sep 17 00:00:00 2001 From: Will Pfleger Date: Mon, 19 Oct 2026 13:37:12 -0400 Subject: [PATCH] test(auth): read the clock once in NIP-FI until test (#8457) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 🤖 The exact NIP-FI assertion-lifetime boundary test could fail when its JWT helper read the clock, then ES256 signing crossed a whole-second boundary. The token's `until` claim could land one second beyond the verifier's `now + skew + maximum_age` ceiling even though both were intended to use the same test instant. This changes the test helper to accept a captured instant and uses that instant for both the JWT time claims and `verify_at`. The boundary remains strict: `now + 3630s` is accepted and `now + 3631s` is rejected. No production code changes. Signed-off-by: Will Pfleger Signed-off-by: Alia Co-authored-by: Alia --- crates/buzz-auth/src/nip_fi/command.rs | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/crates/buzz-auth/src/nip_fi/command.rs b/crates/buzz-auth/src/nip_fi/command.rs index deeae99e75..4b5da49d48 100644 --- a/crates/buzz-auth/src/nip_fi/command.rs +++ b/crates/buzz-auth/src/nip_fi/command.rs @@ -948,7 +948,17 @@ mod tests { until_offset_secs: i64, overrides: serde_json::Value, ) -> String { - let now = now_ts(); + mint_cmd_jwt_at(target, Utc::now(), until_offset_secs, overrides) + } + + /// Mint a command JWT using the supplied instant for all time claims. + fn mint_cmd_jwt_at( + target: &nostr::PublicKey, + now: DateTime, + until_offset_secs: i64, + overrides: serde_json::Value, + ) -> String { + let now = now.timestamp(); let mut claims = serde_json::json!({ "iss": ISS, "aud": AUD, @@ -1225,14 +1235,14 @@ mod tests { let target = target_key(); let now = Utc::now(); for until_offset in [3600, 30 + 3600, 1] { - let token = mint_cmd_jwt(&target, until_offset, serde_json::json!({})); + let token = mint_cmd_jwt_at(&target, now, until_offset, serde_json::json!({})); assert_eq!( cv.verify_at(&token, METHOD, PATH, &target, now).map(|_| ()), Ok(()), "until = now + {until_offset}s must fit the ceiling" ); } - let token = mint_cmd_jwt(&target, 30 + 3600 + 1, serde_json::json!({})); + let token = mint_cmd_jwt_at(&target, now, 30 + 3600 + 1, serde_json::json!({})); assert_eq!( cv.verify_at(&token, METHOD, PATH, &target, now).map(|_| ()), Err(CommandError::UntilExceedsCeiling),