fix(api): default capability tokens to 30-day expiry

[duyetbot]

Summary

• Capability tokens minted without expires_at now expire after 30 days (previously never expired).
• Explicit expiry must be a future Unix-ms integer within 365 days; otherwise 400 INVALID_REQUEST (REST) / tool error (MCP).
• Enforced in the shared capability service so REST and MCP minters behave identically.
• Document the expiry policy in the capability-tokens recipe and MCP tool description.
• Regression tests: default 30-day expiry persisted in DB, past/beyond-max rejection without row creation, explicit 365-day expiry accepted, MCP mint surface.

Verified the regression test fails against the old null-expiry behavior.

Closes #434.

Validation

• Capability + MCP suites: 27 tests passed.
• API TypeScript check passed.

Do not merge: awaiting review per user instruction.

Co-Authored-By: Duyet Le me@duyet.net
Co-Authored-By: duyetbot bot@duyet.net

🤖 Generated with Claude Code

Summary by Sourcery

Enforce bounded expiration for newly minted capability tokens across REST and MCP interfaces.

Bug Fixes:

• Default capability tokens to a persisted 30-day expiry instead of allowing them to remain non-expiring.
• Reject invalid, past, or over-365-day explicit expiries consistently across REST and MCP minting APIs.

Enhancements:

• Centralize capability-token expiry policy and error handling in the shared service while exposing the effective expiry to callers.

Documentation:

• Document default and maximum capability-token expiry policies in the capability-token recipe and MCP tool description.

Tests:

• Add regression coverage for default persistence, expiry validation, maximum supported expiry, and MCP error reporting.

[sourcery-ai]

Sorry @duyetbot, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 19 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 435d202e-2674-40ca-948a-f0ecb6754dc4

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's Guide

Capability-token minting now enforces a shared expiry policy: omitted expiries receive a persisted 30-day TTL, explicit expiries must be future safe Unix-millisecond values within 365 days, and invalid values produce consistent REST or MCP errors before token creation.

Sequence diagram for capability-token expiry enforcement

sequenceDiagram
    participant Client
    participant REST_MCP as REST_or_MCP
    participant Service as CapabilityTokenService
    participant DB

    Client->>REST_MCP: Mint capability token
    REST_MCP->>Service: createCapabilityToken(db, projectId, input)
    alt expires_at omitted
        Service->>Service: Apply 30-day expiry
    else expires_at provided
        Service->>Service: Validate future safe integer within 365 days
        alt Invalid expiry
            Service-->>REST_MCP: CapabilityTokenExpiryError
            REST_MCP-->>Client: INVALID_REQUEST / ToolError
        end
    end
    Service->>DB: Insert token with expiresAt
    DB-->>Service: Created row
    Service-->>REST_MCP: Token response with expires_at
    REST_MCP-->>Client: Mint response

Loading

File-Level Changes

Change	Details	Files
Centralize capability-token expiry defaults and validation in the shared service.	Default omitted or null expiry to 30 days and persist the effective Unix-ms timestamp. Accept only future safe integers no more than 365 days from minting. Raise a typed INVALID_REQUEST error before inserting invalid tokens.	packages/api/src/services/capability-tokens.ts
Translate shared expiry validation failures consistently across REST and MCP minting surfaces.	Map expiry errors to HTTP 400 responses in the REST route. Map expiry errors to MCP tool errors and advertise the expiry policy in the tool description.	packages/api/src/routes/capability-tokens/index.ts packages/api/src/routes/mcp/tools.ts
Document and regression-test the new expiry policy and both minting interfaces.	Document default, maximum, validation, response, and legacy-token behavior. Verify persisted default expiry, boundary acceptance, invalid-request handling without row creation, and MCP response behavior.	docs/recipes/capability-tokens.md packages/api/test/v2-capability-tokens-leases.test.ts packages/api/test/mcp.test.ts

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#434	Ensure capability tokens minted without an explicit expiry receive a default 30-day expiration instead of remaining valid indefinitely.	✅
#434	Reject explicit capability-token expirations that are not future Unix-millisecond timestamps or that exceed a 365-day maximum horizon, consistently across REST and MCP minting paths.	✅
#434	Document and surface the capability-token expiry policy, including the effective expiration and guidance to use shorter delegation lifetimes.	✅

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.