Padreug
b193f6262d
Some checks failed
ci.yml / docs(pairing): TTL + token-revoke now enforced post-bind (nsecbunkerd#27) (pull_request) Failing after 0s
nsecbunkerd#27 (deployed 2026-06-19) reverses the #24 finding: the sign-time ACL now evaluates token lifecycle live on every request (checkIfPubkeyAllowed step 4 joins through a liveWhere filter; applyToken stopped photocopying grants into SigningConditions). So: - duration_hours / token expiresAt now bounds an ESTABLISHED binding — an expired token stops signing post-bind, not just at connect. The prior docstring (connect-window-only, pointing at the now-closed nsecbunkerd#24) is corrected. - Token-revoke is no longer a post-redeem no-op (closes the #22 mechanism bunker-side). revoke_spire keeps using revoke_key_user because that's the subject-level ban cutting the whole binding, not just one token's grant — rationale updated, behavior unchanged. Doc/comment only; 20 pairing tests green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| conftest.py | ||
| test_calculations.py | ||
| test_cassette_configs.py | ||
| test_cassette_state_consumer.py | ||
| test_collision_guard.py | ||
| test_deposit_currency.py | ||
| test_fee_cap_validation.py | ||
| test_fee_mismatch_recording.py | ||
| test_fee_publish_triggers.py | ||
| test_fee_transport.py | ||
| test_nip44_v2.py | ||
| test_nostr_attribution.py | ||
| test_operator_split_legs.py | ||
| test_pair_endpoint.py | ||
| test_pairing.py | ||
| test_principal_based_fees.py | ||
| test_roster_resolver.py | ||