Make Access Decisions Expiry-Aware

[Lakes41]

Difficulty: Hard

Type: Bug

Summary

Update local access decisions so expired memberships are denied even when the active flag is still true.

Current Behaviour

computeAccessDecision() checks membership tier, role, and membership.active, but it does not evaluate membership.expiresAt. If a session contains active: true with an expired expiresAt, the local gate can still allow access.

Expected Behaviour

A membership with an expiry timestamp in the past should be denied. The denied result should include a safe, user-facing reason that can be shown by Gated and related UI components.

Suggested Implementation

Add an expiry check inside computeAccessDecision(). Parse membership.expiresAt only when present, deny access if the timestamp is valid and in the past, and handle malformed dates conservatively. Add tests for active expired memberships, active future memberships, missing expiry, and malformed expiry values.

Files or Areas Likely Affected

• lib/api/access-decision.ts
• components/gated.tsx
• test/access-decision.test.ts
• lib/api/types.ts

Acceptance Criteria

• Active memberships with past expiresAt values are denied.
• Active memberships with future expiresAt values can pass tier and role checks.
• Missing expiresAt preserves current behaviour.
• Invalid expiry strings do not crash the access gate.
• Tests cover expired, valid, missing, and malformed expiry cases.

Additional Notes

This is a frontend safety check and should not replace backend authorisation. Backend access checks should remain the source of truth when available.

[Jenola344]

I'd love to work on this. Experienced with TypeScript, access control, date validation, and testing. I'll deliver a robust, well-tested fix without changing existing authorization behavior.

[clintjeff2]

Hello, I have 6 years of experience working on tasks like this and handling similar challenges across backend, frontend, and smart-contract development. I have carefully read and fully understood the task requirements, and I am confident I can deliver a clean, efficient, and well-tested solution promptly. I always ensure high-quality implementation, maintainability, and adherence to best practices.

Pull request in 10 hours

[gloskull]

Hi, I’d love to work on this issue. I have 4 years of experience across backend, frontend, full-stack, and smart contract development. I understand the task clearly and can deliver a clean, efficient, well-tested solution on time, with strong focus on code quality and maintainability. My PR will be submitted in under 10 hours.

[grantfox-oss]

🦊 GrantFox — @Jenola344 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #58)
2. Your PR will be reviewed by the Adamantine-guild maintainers

Good luck! Track your progress on GrantFox.