feat(auth): expired scoped keys fail authentication (401)

src/server.cpp

@@ -9,14 +9,21 @@ namespace svapi {
 
 ApiServer::ApiServer(ServerDeps deps) : d_(std::move(deps)) {}
 
+static bool keyExpired(const ApiKey& k) {
+    if (!k.scope) return false;
+    auto now = (uint64_t)std::chrono::duration_cast<std::chrono::seconds>(
+        std::chrono::system_clock::now().time_since_epoch()).count();
+    return k.scope->expired(now);
+}
+
 std::optional<ApiKey> resolveKey(ServerDeps& d, const httplib::Request& req) {
     if (auto it = req.headers.find("Authorization"); it != req.headers.end())
         if (auto tok = bearerToken(it->second))
-            if (auto k = d.keys.lookup(*tok)) return k;
+            if (auto k = d.keys.lookup(*tok)) { if (!keyExpired(*k)) return k; return std::nullopt; }
     if (auto it = req.headers.find("Cookie"); it != req.headers.end())
         if (auto c = cookieValue(it->second, "svapi_session"))
             if (auto keyVal = d.sessions.keyFor(*c, std::chrono::system_clock::now()))
-                if (auto k = d.keys.lookup(*keyVal)) return k;
+                if (auto k = d.keys.lookup(*keyVal)) { if (!keyExpired(*k)) return k; return std::nullopt; }
     return std::nullopt;
 }
 ApiKey requireKey(ServerDeps& d, const httplib::Request& req) {