Use bounded Railiance time for protected validity checks

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6

src/secrets_engine/authorization.py

@@ -18,6 +18,7 @@ from typing import Any
 
 from secrets_engine.catalog import CatalogEntry, human_control_required
 from secrets_engine.errors import DecisionError
+from secrets_engine.application_time import validity_bounds
 
 DIGEST_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
 
@@ -335,6 +336,7 @@ def validate_decision_envelope(
     accepted_policy_versions: set[str],
     expected_approval_binding_digest: str = "",
     now: datetime | None = None,
+    time_window=None,
 ) -> ValidatedDecision:
     """Validate a flex-auth DecisionEnvelope against the proposed action.
 
@@ -377,13 +379,13 @@ def validate_decision_envelope(
         raise DecisionError("flex-auth evaluated request digest is malformed")
     _check_approval_binding_digest(binding, expected, expected_approval_binding_digest)
 
-    current = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+    lower, upper = validity_bounds(now, time_window)
     lifetime = _required_dict(envelope, "lifetime")
     expires = _parse_time(lifetime.get("expires_at"), "expires_at")
-    if current >= expires:
+    if upper >= expires:
         raise DecisionError("flex-auth decision lifetime has expired")
     if lifetime.get("not_before") is not None:
-        if current < _parse_time(lifetime.get("not_before"), "not_before"):
+        if lower < _parse_time(lifetime.get("not_before"), "not_before"):
             raise DecisionError("flex-auth decision lifetime has not started")
 
     provenance = _required_dict(envelope, "provenance")