tegwick
06291a97da
make agent-status-token requests --duration=12h and prints the real expiry from the token's exp claim (tools/agent-status/token_expiry.py, never the token), since the API server may cap a duration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
38 lines
1.4 KiB
Python
38 lines
1.4 KiB
Python
"""token_expiry.py on synthetic JWTs (NK-WP-0058-T05): only the expiry is printed."""
|
|
import base64
|
|
import datetime as dt
|
|
import importlib.util
|
|
import json
|
|
from pathlib import Path
|
|
|
|
REPO = Path(__file__).resolve().parents[3]
|
|
spec = importlib.util.spec_from_file_location('token_expiry', REPO / 'tools/agent-status/token_expiry.py')
|
|
te = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(te)
|
|
|
|
|
|
def jwt(exp):
|
|
enc = lambda d: base64.urlsafe_b64encode(json.dumps(d).encode()).decode().rstrip('=')
|
|
return f"{enc({'alg': 'RS256'})}.{enc({'exp': exp, 'sub': 'synthetic'})}.c2lnbmF0dXJl"
|
|
|
|
|
|
def test_prints_expiry_only(tmp_path, capsys):
|
|
exp = int((dt.datetime.now(dt.timezone.utc) + dt.timedelta(hours=12)).timestamp())
|
|
token = tmp_path / 't'
|
|
token.write_text(jwt(exp) + '\n')
|
|
assert te.main([str(token)]) == 0
|
|
out = capsys.readouterr().out
|
|
assert out.startswith('agent-status-token: valid until ')
|
|
assert '(12.0 h)' in out or '(11.9 h)' in out
|
|
assert jwt(exp) not in out and 'synthetic' not in out
|
|
|
|
|
|
def test_expired_missing_and_malformed_fail(tmp_path, capsys):
|
|
old = tmp_path / 'old'
|
|
old.write_text(jwt(int(dt.datetime(2020, 1, 1, tzinfo=dt.timezone.utc).timestamp())))
|
|
assert te.main([str(old)]) == 1
|
|
bad = tmp_path / 'bad'
|
|
bad.write_text('not-a-token')
|
|
assert te.main([str(bad)]) == 1
|
|
assert te.main([str(tmp_path / 'absent')]) == 1
|
|
assert 'not-a-token' not in capsys.readouterr().out
|