web-agent-bridge 3.10.1 → 3.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -145,7 +145,11 @@ function authorizeIntent(intentId, { userId }) {
145
145
  if (!intent) throw notFound('intent not found');
146
146
  if (intent.user_id !== userId) throw forbidden('not your intent');
147
147
  if (intent.status !== 'draft') throw conflict(`cannot authorize intent in status '${intent.status}'`, 'invalid_state');
148
- if (new Date(intent.expires_at).getTime() < Date.now()) {
148
+ // v3.11.0: allow a small clock-skew tolerance so clients on slightly drifted
149
+ // clocks aren't rejected. Default \u00b160s; override via WAB_CLOCK_SKEW_TOLERANCE_SEC.
150
+ const skewSec = Number(process.env.WAB_CLOCK_SKEW_TOLERANCE_SEC || 60);
151
+ const expiresAt = new Date(intent.expires_at).getTime();
152
+ if (expiresAt + (skewSec * 1000) < Date.now()) {
149
153
  db.prepare("UPDATE atp_intents SET status='expired', updated_at=? WHERE id=?").run(nowIso(), intentId);
150
154
  throw conflict('intent expired before authorization', 'expired');
151
155
  }