From 69d4b20fdcf871f0de19a49c3885a436c2a47b1e Mon Sep 17 00:00:00 2001 From: Sumer Johal Date: Wed, 26 Aug 2026 21:06:35 -0700 Subject: [PATCH] testkit: add --days flag to the credential minter The non-expired test credentials were hardcoded to a 30-day window. The copies committed into the ar2 verifier tests crossed that cliff on Aug 20: test_valid_grant and three siblings began failing on every branch, and worse, the tampered/revoked fixtures kept "passing" vacuously -- rejected for expiry rather than for the property under test. Companion ar2 PR re-mints those fixtures with --days 365 and adds a conftest guard that fails loudly with the re-mint command when fixtures approach expiry. Co-authored-by: Cursor --- .../grants/testkit/mint_test_credentials.py | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/services/pancake_services/grants/testkit/mint_test_credentials.py b/services/pancake_services/grants/testkit/mint_test_credentials.py index daee2b1..85a5943 100644 --- a/services/pancake_services/grants/testkit/mint_test_credentials.py +++ b/services/pancake_services/grants/testkit/mint_test_credentials.py @@ -78,7 +78,7 @@ def build_odrl(jti: str, list_id: str, exp: int) -> dict: } -def mint_all(out_dir: Path) -> dict: +def mint_all(out_dir: Path, validity_days: int = 30) -> dict: out_dir.mkdir(parents=True, exist_ok=True) private_pem, public_pem = generate_keypair_pem() (out_dir / "dev_issuer_private.pem").write_bytes(private_pem) @@ -86,7 +86,7 @@ def mint_all(out_dir: Path) -> dict: list_id = merkle.merkle_root(DEV_GEOIDS) now = int(time.time()) - future = now + 30 * 24 * 3600 + future = now + validity_days * 24 * 3600 past = now - 3600 creds = {} @@ -156,9 +156,16 @@ def mint_all(out_dir: Path) -> dict: def main() -> None: parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--out", default=str(Path(__file__).parent / "dev_keys")) + parser.add_argument( + "--days", type=int, default=30, + help="validity window for the non-expired credentials. Fixtures that " + "are committed into another repo (ar2's verifier tests) should " + "use a long window: when 'tampered' or 'revoked' expires, the " + "verifier still rejects it -- but for the wrong reason, and the " + "test passes while testing nothing.") args = parser.parse_args() - manifest = mint_all(Path(args.out)) + manifest = mint_all(Path(args.out), validity_days=args.days) print(f"Minted {len(manifest['credentials'])} test credentials into {args.out}") print(f"ListID: {manifest['list_id']}")