From d38b9acea6e59b7f54b6988608a879e34676f731 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 21 Sep 2026 19:06:42 +0200 Subject: [PATCH] Tolerate workstation clock skew in the sitting-requester token check A 3 s WSL2 clock lag made a freshly issued KeyCape token fail PyJWT's iat check (ImmatureSignatureError), surfacing only as contained_operation_failed. Allow 30 s leeway and record the exception class, never its message. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 272244@bnt-lap001 Assistant-Session: c8962fa7-b290-47df-865f-403ddb6c77e9 --- tools/create_sitting_approvals.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/create_sitting_approvals.py b/tools/create_sitting_approvals.py index 3165732..f61d6a4 100644 --- a/tools/create_sitting_approvals.py +++ b/tools/create_sitting_approvals.py @@ -156,7 +156,7 @@ def main() -> int: try: _create(rows, origin.rstrip("/"), receipt) except Exception as error: - receipt["failure"] = str(error) if isinstance(error, Refused) else "contained_operation_failed" + receipt["failure"] = str(error) if isinstance(error, Refused) else "contained_operation_failed:" + type(error).__name__ print(receipt["failure"], file=sys.stderr) return 2 finally: @@ -236,6 +236,7 @@ def _create(rows, origin, receipt): algorithms=["RS256"], issuer=ISSUER, audience="approval-engine", + leeway=30, options={"strict_aud": True, "require": ["sub", "iat", "exp", "iss", "aud"]}, ) roles = claims.get("roles")