feat: enforce keyset expiry

[gudnuf]

closes #1895

Description

Enforces keyset expiry by rejecting inputs and outputs for an expired keyset. The expired keyset stays active.

---

Notes to the reviewers

This doesn't handle the wallet side of things. Also, while working on the tests I realized that the mint allows for keysets to be rotated with an expiry in the past, I created an issue for that #1945

---

Suggested CHANGELOG Updates

CHANGED

ADDED

REMOVED

FIXED

---

Checklist

• I followed the code style guidelines
• I ran just quick-check before committing
• If the Wallet API was modified (added/removed/changed), I have reflected those changes in the FFI bindings (crates/cdk-ffi)

[codecov]

Codecov Report

❌ Patch coverage is 90.52632% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.57%. Comparing base (b3e5de8) to head (d31acec).
⚠️ Report is 5 commits behind head on main.

Files with missing lines	Patch %	Lines
crates/cdk-common/src/error.rs	0.00%	7 Missing ⚠️
crates/cdk-signatory/src/common.rs	0.00%	4 Missing ⚠️
crates/cdk/src/mint/builder.rs	0.00%	4 Missing ⚠️
crates/cdk/src/mint/mod.rs	95.16%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1946      +/-   ##
==========================================
+ Coverage   65.49%   65.57%   +0.08%     
==========================================
  Files         330      330              
  Lines       57554    57744     +190     
==========================================
+ Hits        37695    37867     +172     
- Misses      19859    19877      +18     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[TheMhv]

How i can test it? I try to change the active and valid_to fields directly in keyset table inside mint database but does work

[gudnuf]

How i can test it?

use the management RPC CLI to rotate

mintd-cli  rotate-next-keyset --final-expiry $(($(date +%s) + SECONDS_IN_THE_FUTURE))

Then mint ecash before SECONDS_IN_THE_FUTURE. Wait for expiry, then try to use that ecash.

I try to change the active and valid_to fields directly in keyset table inside mint database but does work

I'm not sure that works because the keyset ID commits to the expiry and mintd will auto-rotate on startup if you have no active keys. Also the mint might keep the active keys in memory.

[TheMhv]

The error occurs after invoice has created and paid, i think that the validation needs to be before the invoice creation.

---

[gudnuf]

The error occurs after invoice has created and paid, i think that the validation needs to be before the invoice creation.

Yea this is tricky because keyset can also expire after the quote is created like I described here #1895 (comment)

So we could return an error for the request to create a mint quote if the active keyset is expired, but that only solves half the problem. Do you have any suggestion on how this should work @TheMhv?

I think that this just needs to be handle client side by checking the keyset expiry.

[TheMhv]

Do you have any suggestion on how this should work @TheMhv?

I cannot create new mint quotes from expired keyset, the mint should return an error.

Beside that, we can has mint quotes that was created when keyset was valid, but now it's expired. For this case i have one idea, we can create a "quote renew" request that requires a payment proof (the preimage for lightning payments for example) for renew the paid mint quote to the new keyset.

[thesimplekid]

The error occurs after invoice has created and paid, i think that the validation needs to be before the invoice creation.

Yea this is tricky because keyset can also expire after the quote is created like I described here #1895 (comment)

So we could return an error for the request to create a mint quote if the active keyset is expired, but that only solves half the problem. Do you have any suggestion on how this should work @TheMhv?

I think that this just needs to be handle client side by checking the keyset expiry.

We could disable minting if there is no active keyset but really that doesn't always solve the problem since you could have got a mint quote before the expiry and then attempt to mint after, no check we can do can protect from that. I think its an edge case and mints generally won't be running in this state it is only if they are shutting down.