fix(rpc): validate API key expiration dates

Merged
FL
7h ago
+68-2

Description

API key creation and updates currently accept expiration strings without checking their format or whether they are already expired. This validates a supplied expiration as an ISO 8601 timestamp strictly later than the current time and returns BAD_REQUEST before key generation, persistence, or cache invalidation.

Omitting an expiration on create still creates a key without one. On update, null clears the expiration and omission leaves it unchanged.

Fixes #895.

The contributor has confirmed manual verification and maintainer acceptance of #895.

Slice

  • Issue: #895
  • Scope / owning surface: API key create/update procedures in packages/rpc
  • Dependencies or overlapping PRs: None found in the open PRs checked

Validation

  • Added 27 procedure-level regression cases covering malformed and impossible dates, past/equal timestamps, time-zone offsets, future dates, and null/omitted values. The 16 invalid-input cases failed before the fix and pass with it.
  • RPC suite: 265 passed, 28 skipped, 0 failed. ClickHouse integration cases were skipped because the required services were not running.
  • bun run lint: passed, including the repository policy checks.
  • bun run check-types: passed, all 37 tasks successful. Ran the docs' fumadocs-mdx generator first to provide its generated types.
  • Direct TypeScript check of the expiration test file: passed.
  • Manual verification of expiration behavior: completed by the contributor.

AI assistance

OpenAI Codex helped investigate the issue, validation, help in refine the regression tests, and draft this description.

Checklist
  • This branch started from current staging and includes no other unmerged PR.
  • This is one independently reviewable slice.
  • Open PRs were checked for overlapping work.
  • The intended PR base is staging.
  • Code follows the project's style guidelines.
  • I have personally reviewed the complete change and verified it through human use.
  • Regression tests demonstrate the fix.
  • New and existing RPC unit tests pass locally.
  • A maintainer has accepted the referenced issue (confirmed by the contributor).

Summary by cubic

Validates API key expiration dates on create and update, rejecting malformed or already-past timestamps before any key generation, persistence, or cache invalidation.

  • Expiration must be a valid ISO 8601 timestamp with a timezone, strictly later than the current time.
  • Omitting expiration on create still creates a key without one; on update, null clears it and omission leaves it unchanged.
  • Adds regression tests for invalid, past, equal, time-zone offset, future, and null/omitted values. Fixes #895.