fix(rpc): validate API key expiration dates

[Flamki]

Description

API key creation and updates currently accept expiration strings without checking their format or whether they are already expired. This validates a supplied expiration as an ISO 8601 timestamp strictly later than the current time and returns BAD_REQUEST before key generation, persistence, or cache invalidation.

Omitting an expiration on create still creates a key without one. On update, null clears the expiration and omission leaves it unchanged.

Fixes #895.

The contributor has confirmed manual verification and maintainer acceptance of #895.

Slice

• Issue: fix(rpc): reject invalid or past API key expiration dates #895
• Scope / owning surface: API key create/update procedures in packages/rpc
• Dependencies or overlapping PRs: None found in the open PRs checked

Validation

• Added 27 procedure-level regression cases covering malformed and impossible dates, past/equal timestamps, time-zone offsets, future dates, and null/omitted values. The 16 invalid-input cases failed before the fix and pass with it.
• RPC suite: 265 passed, 28 skipped, 0 failed. ClickHouse integration cases were skipped because the required services were not running.
• bun run lint: passed, including the repository policy checks.
• bun run check-types: passed, all 37 tasks successful. Ran the docs' fumadocs-mdx generator first to provide its generated types.
• Direct TypeScript check of the expiration test file: passed.
• Manual verification of expiration behavior: completed by the contributor.

AI assistance

OpenAI Codex helped investigate the issue, validation, help in refine the regression tests, and draft this description.

Checklist

• This branch started from current staging and includes no other unmerged PR.
• This is one independently reviewable slice.
• Open PRs were checked for overlapping work.
• The intended PR base is staging.
• Code follows the project's style guidelines.
• I have personally reviewed the complete change and verified it through human use.
• Regression tests demonstrate the fix.
• New and existing RPC unit tests pass locally.
• A maintainer has accepted the referenced issue (confirmed by the contributor).

---

Summary by cubic

Validates API key expiration dates on create and update, rejecting malformed or already-past timestamps before any key generation, persistence, or cache invalidation.

• Expiration must be a valid ISO 8601 timestamp with a timezone, strictly later than the current time.
• Omitting expiration on create still creates a key without one; on update, null clears it and omission leaves it unchanged.
• Adds regression tests for invalid, past, equal, time-zone offset, future, and null/omitted values. Fixes fix(rpc): reject invalid or past API key expiration dates #895.

^{Written for commit 705b453. Summary will update on new commits.}

[vercel]

@Flamki is attempting to deploy a commit to the Databuddy OSS Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
documentation	Skipped		Oct 17, 2026 5:51pm UTC

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 322f46c3-bb2c-43a4-82c3-cfbe07caf9b5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 4/5

[Critical risk] Adds validation to API key expiration dates in creation and update.

The expiration change appears sound, but the new tests need to satisfy the repository’s mock-data and type rules before merging.

Findings

1.  Test uses made-up permissions ▶
2.  Test loses value type checks ▶

Summary

API key create and update now reject supplied expiration dates that are malformed or not strictly in the future. Missing and null values keep their existing meanings.

• Invalid dates return BAD_REQUEST before key creation or update side effects.
• Valid future timestamps are saved; create omission and update null or omission retain their existing behavior.

_{Reviews (1) · Last reviewed commit: "fix(rpc): validate API key expiration da..."}