Protocol: require canonical client authority expiry

2026-08-12 12:03:36 +07:00
parent afbcea62f9
commit 4693102b3c
6 changed files with 13 additions and 5 deletions
@@ -76,6 +76,14 @@ def main() -> int:
    assert tunnel_credential["required"] == [
        "client_device_id", "device_key_id", "certificate_chain_pem", "trust_bundle_pem", "expires_at"
    ]
+    client_authority_expiry = defs["ClientSessionAuthority"]["properties"]["expires_at"]
+    assert client_authority_expiry["format"] == "date-time"
+    client_authority_expiry_pattern = re.compile(client_authority_expiry.get("pattern", r"(?!)"))
+    assert client_authority_expiry_pattern.fullmatch("2099-01-01T00:00:00Z"), "client authority expiry must accept canonical UTC"
+    for noncanonical_expiry in ("2099-01-01T00:00:00+00:00", "2099-01-01T00:00:00.100Z"):
+        assert not client_authority_expiry_pattern.fullmatch(noncanonical_expiry), (
+            f"client authority expiry accepted noncanonical UTC {noncanonical_expiry}"
+        )

    manifest = json.loads((ROOT / "fixtures/valid/manifest.json").read_text(encoding="utf-8"))
    assert set(manifest).issubset(set(defs["ConnectionManifest"]["properties"]))