Merge pull request #64 from POORT8/codex/update-conditions-in-verifylifetime-and-add-tests

Fix lifetime check

Author: mabvanaartrijk

Poort8.Ishare.Core.Tests/AuthorizationRegistryServiceTests.cs

@@ -86,6 +86,50 @@ public void VerifyInvalidLifetimeShouldFail()
         permit.Should().BeFalse();
     }
 
+    [Fact]
+    public void VerifyDelegationEvidencePermit_NotBeforeEqualNow_ShouldPass()
+    {
+        var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        var fakeDelegationEvidence = CreateFakeDelegationEvidence() with
+        {
+            NotBefore = now,
+            NotOnOrAfter = now + 10
+        };
+
+        var permit = _authorizationRegistryService.VerifyDelegationEvidencePermit(
+            fakeDelegationEvidence,
+            fakeDelegationEvidence.PolicyIssuer,
+            fakeDelegationEvidence.Target.AccessSubject,
+            fakeDelegationEvidence.PolicySets[0].Policies[0].Target.Environment.ServiceProviders[0],
+            fakeDelegationEvidence.PolicySets[0].Policies[0].Target.Resource.Type,
+            fakeDelegationEvidence.PolicySets[0].Policies[0].Target.Resource.Identifiers[0],
+            fakeDelegationEvidence.PolicySets[0].Policies[0].Target.Actions[0]);
+
+        permit.Should().BeTrue();
+    }
+
+    [Fact]
+    public void VerifyDelegationEvidencePermit_NotOnOrAfterEqualNow_ShouldFail()
+    {
+        var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
+        var fakeDelegationEvidence = CreateFakeDelegationEvidence() with
+        {
+            NotBefore = now - 10,
+            NotOnOrAfter = now
+        };
+
+        var permit = _authorizationRegistryService.VerifyDelegationEvidencePermit(
+            fakeDelegationEvidence,
+            fakeDelegationEvidence.PolicyIssuer,
+            fakeDelegationEvidence.Target.AccessSubject,
+            fakeDelegationEvidence.PolicySets[0].Policies[0].Target.Environment.ServiceProviders[0],
+            fakeDelegationEvidence.PolicySets[0].Policies[0].Target.Resource.Type,
+            fakeDelegationEvidence.PolicySets[0].Policies[0].Target.Resource.Identifiers[0],
+            fakeDelegationEvidence.PolicySets[0].Policies[0].Target.Actions[0]);
+
+        permit.Should().BeFalse();
+    }
+
     [Fact]
     public void VerifyDelegationEvidencePermit_ValidConditions_ShouldPass()
     {

Poort8.Ishare.Core/AuthorizationRegistryService.cs

@@ -214,8 +214,8 @@ private static DelegationEvidence DecodeDelegationToken(string token)
     private static bool VerifyLifetime(ILogger<AuthorizationRegistryService> logger, DelegationEvidence delegationEvidence)
     {
         var now = DateTimeOffset.UtcNow.ToUnixTimeSeconds();
-        if (delegationEvidence.NotBefore >= now ||
-            delegationEvidence.NotOnOrAfter < now)
+        if (delegationEvidence.NotBefore > now ||
+            delegationEvidence.NotOnOrAfter <= now)
         {
             logger.LogWarning("Invalid token lifetime, notBefore {notBefore} or notOnOrAfter {NotOnOrAfter} is not valid: now {now}", delegationEvidence.NotBefore, delegationEvidence.NotOnOrAfter, now);
             return false;