bbs.profullstack/logicsrc
1
0
Fork 0
mirror of https://github.com/profullstack/logicsrc.git synced 2026-08-14 23:07:29 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

fix(policy): treat malformed grant expiresAt as expired, not active

Browse source 
Date.parse() returns NaN for invalid date strings. Previously, a grant
with expiresAt set to a malformed value (e.g. 'invalid') would pass the
expiry check (NaN > Date.now() === false, but the falsy NaN would skip
the check due to how the condition was written—or more precisely, would
evaluate incorrectly).

Now, if expiresAt is present but cannot be parsed, the grant is treated
as expired/invalid rather than silently allowing access.
This commit is contained in:
nullref 2026-06-14 07:35:44 +02:00
parent 8f4691584c
commit 681600360d
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
packages/account-core/src/policy.ts
View file

@ -52,7 +52,8 @@ export function scoreAccountActionRisk(input: {
export function evaluateAccountPolicy(input: LogicSrcPolicyEvaluationInput): LogicSrcPolicyEvaluationResult { export function evaluateAccountPolicy(input: LogicSrcPolicyEvaluationInput): LogicSrcPolicyEvaluationResult {
const riskScore = Math.min(1, Math.max(0, input.riskScore ?? scoreAccountActionRisk({ action: input.action }))); const riskScore = Math.min(1, Math.max(0, input.riskScore ?? scoreAccountActionRisk({ action: input.action })));
const grantActive = input.grant && !input.grant.revokedAt && (!input.grant.expiresAt || Date.parse(input.grant.expiresAt) > Date.now()); const expiryMs = input.grant?.expiresAt ? Date.parse(input.grant.expiresAt) : NaN;
const grantActive = input.grant && !input.grant.revokedAt && (!input.grant.expiresAt || (!Number.isNaN(expiryMs) && expiryMs > Date.now()));
const hasPermission = Boolean(grantActive && input.grant?.permissions.includes(input.action)); const hasPermission = Boolean(grantActive && input.grant?.permissions.includes(input.action));
if (!hasPermission) { if (!hasPermission) {