@rodit/rodit-auth-be 9.17.0 → 9.17.1

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to `@rodit/rodit-auth-be` are documented here.
 
+## [9.17.1] — 2026-10-20
+
+### Fixed
+
+- **Login challenge max-age:** `validateTimestamp` again rejects challenges older
+  than `API_DEFAULT_OPTIONS.TIMESTAMP_MAX_AGE` (default 300s). Stale captured
+  `POST /api/login` bodies can no longer mint session JWTs indefinitely.
+  `verify_peer_rodit` passes the configured max age into the check.
+
 ## [9.17.0] — 2026-10-06
 
 ### Fixed

package/README.md

@@ -4,7 +4,7 @@ Node.js / Express SDK for RODiT-based mutual authentication, authorization, sess
 
 **npm:** [https://www.npmjs.com/package/@rodit/rodit-auth-be](https://www.npmjs.com/package/@rodit/rodit-auth-be)  
 **Monorepo:** [discernible-io/rodit-sdk](https://github.com/discernible-io/rodit-sdk) (this directory)  
-**Version:** 9.17.0 · **License:** Proprietary · **Author:** Discernible IO
+**Version:** 9.17.1 · **License:** Proprietary · **Author:** Discernible IO
 
 ## Production deployments
 

package/index.js

@@ -1162,7 +1162,7 @@ class RoditClient {
 
         switch (errorCode) {
           case 'LOGIN_CHALLENGE_TIMESTAMP_INVALID':
-            errorMessage += '\n→ [CLIENT REJECTED] The login challenge timestamp is invalid or too far in the future. Use timestamp and timestamp_iso from one GET /api/login/timestamp call and check your system clock.';
+            errorMessage += '\n→ [CLIENT REJECTED] The login challenge timestamp is invalid, too far in the future, or older than the allowed max age. Fetch a fresh timestamp and timestamp_iso from GET /api/login/timestamp and check your system clock.';
             break;
           case 'RODIT_NOT_FOUND':
             errorMessage += '\n→ [CLIENT REJECTED] The RODiT was not found on the blockchain. Verify the RODiT ID is correct.';

package/lib/auth/authentication.js

@@ -27,6 +27,7 @@ const {
   buildLoginSigningMessageBytes,
   tryConsumeLoginNonce,
 } = require("./login-nonce");
+const config = require("../../services/configsdk");
 
 async function verify_rodit_ownership(
     peerroditid,
@@ -730,17 +731,26 @@ async function verify_rodit_ownership(
   }
 
   /**
-   * Validates that a timestamp is not in the future
-   * 
+   * Validates that a login challenge timestamp is within skew and max-age bounds.
+   *
    * @param {number} timestamp - Unix timestamp in seconds
-   * @param {number} maxAgeSeconds - Maximum age in seconds (not used, kept for backward compatibility)
+   * @param {number} [maxAgeSeconds] - Maximum challenge age in seconds (defaults to API_DEFAULT_OPTIONS.TIMESTAMP_MAX_AGE)
    * @returns {Promise<boolean>} True if timestamp is valid, false otherwise
    */
-  async function validateTimestamp(timestamp, maxAgeSeconds = 300) {
+  async function validateTimestamp(timestamp, maxAgeSeconds) {
     const requestId = ulid();
     const currentTime = Math.floor(Date.now() / 1000);
     const timeDifference = currentTime - timestamp;
-    
+    const configuredMaxAge = Number(
+      config.get("API_DEFAULT_OPTIONS.TIMESTAMP_MAX_AGE", 300)
+    );
+    const resolvedMaxAge =
+      Number.isFinite(maxAgeSeconds) && maxAgeSeconds > 0
+        ? maxAgeSeconds
+        : Number.isFinite(configuredMaxAge) && configuredMaxAge > 0
+          ? configuredMaxAge
+          : 300;
+
     // Check if timestamp is in the future (with small buffer for clock skew)
     if (timestamp > currentTime + 30) {
       logger.warn("Authentication rejected: timestamp is in the future", {
@@ -753,10 +763,20 @@ async function verify_rodit_ownership(
       });
       return false;
     }
-    
-    // We've removed the timestamp age check as it's not needed with our comprehensive validation system
-    // The system already validates tokens through other means
-    
+
+    if (timeDifference > resolvedMaxAge) {
+      logger.warn("Authentication rejected: timestamp too old", {
+        component: "RoditAuth",
+        method: "validateTimestamp",
+        requestId,
+        timestamp,
+        currentTime,
+        maxAgeSeconds: resolvedMaxAge,
+        ageSeconds: timeDifference,
+      });
+      return false;
+    }
+
     return true;
   }
 
@@ -833,7 +853,13 @@ async function verify_rodit_ownership(
     });
 
     try {
-      const timestampValid = await validateTimestamp(peertimestamp);
+      const timestampMaxAge = Number(
+        config.get("API_DEFAULT_OPTIONS.TIMESTAMP_MAX_AGE", 300)
+      );
+      const timestampValid = await validateTimestamp(
+        peertimestamp,
+        timestampMaxAge
+      );
 
       if (!timestampValid) {
         logger.warn("Invalid timestamp, aborting RODiT verification", {
@@ -843,13 +869,14 @@ async function verify_rodit_ownership(
           roditId: peerroditid,
           timestamp: peertimestamp,
           currentTime: Math.floor(Date.now() / 1000),
+          maxAgeSeconds: timestampMaxAge,
         });
         return {
           peer_rodit: null,
           goodrodit: false,
           failureReason: "LOGIN_CHALLENGE_TIMESTAMP_INVALID",
           failureMessage:
-            "Login challenge timestamp invalid: the Unix `timestamp` from your POST body is too far in the future relative to server time (use the `timestamp` from the same GET /api/login/timestamp response as your login signing payload; check clock skew)."
+            "Login challenge timestamp invalid: the Unix `timestamp` from your POST body is too far in the future or older than the allowed max age relative to server time (use a fresh `timestamp` from GET /api/login/timestamp for the same login signing payload; check clock skew)."
         };
       }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rodit/rodit-auth-be",
-  "version": "9.17.0",
+  "version": "9.17.1",
   "description": "RODiT-based authentication system for Express.js applications",
   "main": "index.js",
   "exports": {