Protocol: require canonical client authority expiry

gen/go/protocol/protocol.go

@@ -14,7 +14,7 @@ import (
 	"time"
 )
 
-const SchemaSHA256 = "762d009c3d25d80c3850d975e45f7a6b3fd8adf5c93c8fa7dd11dfa993f8bbb1"
+const SchemaSHA256 = "b2353c12269304289b4e872f27cc370ae61b958dea90d9fb7b6ab8afd7d37248"
 const ProtocolVersion = "1.0.0"
 const CurrentWireVersion = "2"
 const NMinus1WireVersion = "1"

gen/manifest.json

@@ -14,5 +14,5 @@
   },
   "generator_sha256": "00c1905fc611ca9e226cd90da761b48b8e203734b10542befea397a30082d360",
   "protocol_version": "1.0.0",
-  "schema_sha256": "762d009c3d25d80c3850d975e45f7a6b3fd8adf5c93c8fa7dd11dfa993f8bbb1"
+  "schema_sha256": "b2353c12269304289b4e872f27cc370ae61b958dea90d9fb7b6ab8afd7d37248"
 }

gen/rust/protocol.rs

@@ -1,6 +1,6 @@
 // Code generated by tools/generate.py; DO NOT EDIT.
 #![allow(non_snake_case)]
-pub const SCHEMA_SHA256: &str = "762d009c3d25d80c3850d975e45f7a6b3fd8adf5c93c8fa7dd11dfa993f8bbb1";
+pub const SCHEMA_SHA256: &str = "b2353c12269304289b4e872f27cc370ae61b958dea90d9fb7b6ab8afd7d37248";
 pub const CURRENT_WIRE_VERSION: &str = "2";
 pub const N_MINUS_1_WIRE_VERSION: &str = "1";
 pub const N_MINUS_2_WIRE_VERSION: &str = "0";

gen/swift/Protocol.swift

@@ -1,7 +1,7 @@
 // Code generated by tools/generate.py; DO NOT EDIT.
 import Foundation
 public typealias JSONObject = [String: String]
-public let schemaSHA256 = "762d009c3d25d80c3850d975e45f7a6b3fd8adf5c93c8fa7dd11dfa993f8bbb1"
+public let schemaSHA256 = "b2353c12269304289b4e872f27cc370ae61b958dea90d9fb7b6ab8afd7d37248"
 public let currentWireVersion = "2"
 public let nMinus1WireVersion = "1"
 public let nMinus2WireVersion = "0"

schemas/control-v1.schema.json

@@ -561,7 +561,7 @@
         "gateway_id": {"type": "string", "minLength": 1, "maxLength": 128},
         "audience": {"type": "string", "minLength": 1, "maxLength": 256},
         "reconnect_sequence": {"type": "integer", "minimum": 0},
-        "expires_at": {"type": "string", "format": "date-time", "maxLength": 64},
+        "expires_at": {"type": "string", "format": "date-time", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$", "maxLength": 64},
         "capabilities": {"$ref": "#/$defs/CapabilityProfile"}
       }
     },

tools/validate.py

@@ -76,6 +76,14 @@ def main() -> int:
     assert tunnel_credential["required"] == [
         "client_device_id", "device_key_id", "certificate_chain_pem", "trust_bundle_pem", "expires_at"
     ]
+    client_authority_expiry = defs["ClientSessionAuthority"]["properties"]["expires_at"]
+    assert client_authority_expiry["format"] == "date-time"
+    client_authority_expiry_pattern = re.compile(client_authority_expiry.get("pattern", r"(?!)"))
+    assert client_authority_expiry_pattern.fullmatch("2099-01-01T00:00:00Z"), "client authority expiry must accept canonical UTC"
+    for noncanonical_expiry in ("2099-01-01T00:00:00+00:00", "2099-01-01T00:00:00.100Z"):
+        assert not client_authority_expiry_pattern.fullmatch(noncanonical_expiry), (
+            f"client authority expiry accepted noncanonical UTC {noncanonical_expiry}"
+        )
 
     manifest = json.loads((ROOT / "fixtures/valid/manifest.json").read_text(encoding="utf-8"))
     assert set(manifest).issubset(set(defs["ConnectionManifest"]["properties"]))