@davidvornholt/standards 0.15.0 → 0.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -30,6 +30,7 @@
     "src/creds-cloudflare.ts",
     "src/creds-cloudflare-api.ts",
     "src/creds-cloudflare-condition.ts",
+    "src/creds-cloudflare-expiry.ts",
     "src/creds-cloudflare-pagination.ts",
     "src/creds-commands.ts",
     "src/creds-args.ts",

package/src/creds-add.ts

@@ -2,6 +2,7 @@ import { commitCreatedCloudflareToken } from './creds-add-cloudflare-commit';
 import { findManagedDestinationCollision } from './creds-add-collision';
 import { resolveTokenPolicy } from './creds-add-policy';
 import { createAccountToken } from './creds-cloudflare';
+import { cloudflareExpiresOn } from './creds-cloudflare-expiry';
 import { resolveContext, selectAccount } from './creds-dest';
 import { tokenNameOf } from './creds-naming';
 import {
@@ -117,7 +118,7 @@ export const runCredsAddCloudflare = async (
     return false;
   }
   const ttlDays = options.ttlDays ?? DEFAULT_TTL_DAYS;
-  const expiresOn = new Date(Date.now() + ttlDays * DAY_MS).toISOString();
+  const expiresOn = cloudflareExpiresOn(Date.now() + ttlDays * DAY_MS);
   const created = await createAccountToken(account.accountId, account.token, {
     name,
     expiresOn,

package/src/creds-cloudflare-expiry.ts

@@ -0,0 +1,7 @@
+// Cloudflare rejects fractional seconds in expires_on before creating the
+// token; it requires whole-second RFC3339 like "2005-12-30T01:02:03Z".
+
+const FRACTIONAL_SECONDS = /\.\d{3}Z$/u;
+
+export const cloudflareExpiresOn = (epochMs: number): string =>
+  new Date(epochMs).toISOString().replace(FRACTIONAL_SECONDS, 'Z');

package/src/creds-plan.ts

@@ -5,6 +5,7 @@
 // lifetime. Secret keys without a brokered token are simply unmanaged — most
 // secrets are — and are never touched. Execution lives in creds-plan-run.ts.
 
+import { cloudflareExpiresOn } from './creds-cloudflare-expiry';
 import { parseTokenName } from './creds-naming';
 import { groupByIntersectingFootprint } from './creds-plan-groups';
 import type {
@@ -105,9 +106,9 @@ const dispositionOf = (
       format,
       policies: token.policies,
       condition: token.condition.value,
-      replacementExpiresOn: new Date(
+      replacementExpiresOn: cloudflareExpiresOn(
         input.now.getTime() + expiry - issued,
-      ).toISOString(),
+      ),
       reason: `expires ${token.expiresOn}`,
     },
   };