fix(ack-pay): enforce payment request expiresAt

[MrFaruk0]

PaymentRequest.expiresAt is documented as the point after which a payment request becomes invalid, but verifyPaymentRequestToken only enforced the standard JWT exp claim.

Payment requests created through ACK-Pay carry expiresAt in the JWT payload without an exp claim, so a validly signed request with a past expiresAt was still accepted by the default verification path.

Fix: after parsing the payment request, reject it when expiresAt has passed and expiry verification is enabled. verifyExpiry: false continues to skip expiry checks, preserving the existing receipt-verification behavior where receipts may outlive the payment request.

Tests: added regression coverage for past and future expiresAt values, verifyExpiry: false, and verifying a receipt over an expired payment request.

Changeset: added (@agentcommercekit/ack-pay, patch).

Related to #120, but non-overlapping: that PR validates and normalizes expiresAt values at the schema level; this change enforces the parsed timestamp during verification.

Verified locally: @agentcommercekit/ack-pay tests (38/38), package build, oxlint, oxfmt --check, and git diff --check.

---

AI usage disclosure (per AI_POLICY.md): this fix was developed with AI assistance (Codex - GPT 5.6 Sol). I reviewed the final diff and understand the change.

Summary by CodeRabbit

• New Features
  • Added expiration validation for payment requests when expiry verification is enabled.
  • Expired payment requests are rejected, while future-dated requests are accepted.
  • Expiry checks can be disabled when needed.
  • Payment receipts referencing expired requests continue to validate successfully.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7b9d2cec-5425-4021-b8d8-4b24b08fd1a4

📥 Commits

Reviewing files that changed from the base of the PR and between 0b8fdaa and b0b61c5.

📒 Files selected for processing (4)

• .changeset/ack-pay-expires-at-verification.md
• packages/ack-pay/src/verify-payment-receipt.test.ts
• packages/ack-pay/src/verify-payment-request-token.test.ts
• packages/ack-pay/src/verify-payment-request-token.ts

---

Walkthrough

Payment request token verification now validates expiresAt when verifyExpiry is enabled. Tests cover expired, future, and disabled verification cases. Receipt verification remains successful for expired requests, and a patch changeset documents the behavior.

Changes

Payment request expiry verification

Layer / File(s)	Summary
PaymentRequest expiry validation packages/ack-pay/src/verify-payment-request-token.ts	verifyExpiry now covers JWT exp and PaymentRequest expiresAt. Expired requests throw InvalidPaymentRequestTokenError.
Token expiry behavior tests packages/ack-pay/src/verify-payment-request-token.test.ts	Tests cover expired requests, future-dated requests, and expired requests with expiry verification disabled.
Receipt verification coverage packages/ack-pay/src/verify-payment-receipt.test.ts, .changeset/ack-pay-expires-at-verification.md	Tests verify receipts linked to expired payment requests. The changeset documents the expiry rejection behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b0b61

The change adds enforcement for expired payment requests while preserving receipt verification behavior when expiry checks are disabled; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: venables

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes enforcement of the payment request expiresAt field, which is the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[venables]

This change causes a downstream error in examples/issuer/src/routes/receipts.ts:221-226: The receipt revoke route calls verifyPaymentRequestToken with only resolver, so after this PR it throws InvalidPaymentRequestTokenError for any receipt whose request expiresAt has passed. The route only needs parsed.issuer.

Likely have to pass verifyExpiry: false in that call, the same way verifyPaymentReceipt does.

[venables]

The did-jwt library includes a skew variable to allow for clock drift, which we may want to support here? (defaults to 300 https://github.com/decentralized-identity/did-jwt/blob/master/src/JWT.ts#L522C97-L522C105)