fix: reject non-finite DID token iat/ext/nbf

[SashaMIT]

Pull Request

Token.validate compared ext and nbf with > / < only. Python json.loads accepts NaN and Infinity by default. Those comparisons are always false, so ext: Infinity never expired and nbf: NaN never blocked use. A string such as "never" raised TypeError instead of DIDTokenMalformed.

Fail-closed: iat / ext / nbf must be finite numbers. Language-split of magiclabs/magic-admin-js#156. Distinct from that JS PR (this is the Python admin SDK).

Threat-model: the attacker presents a signed DID token whose claim times are non-finite or non-numeric. They do not control the verifier clock. After decode, the signature can still be valid, and validate still returned success (or crashed) instead of rejecting the token.

Versioning

• Patch: Bug Fix?
• Minor: New Feature?
• Major: Breaking Change?

Fixed Issues

• Fixes DID token validate fails open on non-finite ext/nbf/iat #138

Test instructions

pytest tests/unit/resources/token_test.py
# 19/19
pytest tests/unit
# 103/103

Revert-tested: removing the is_finite checks in Token.validate makes test_validate_raises_error_if_ext_is_not_finite fail (Infinity is accepted).

Update CHANGELOG.md

• I have updated the Upcoming Changes section of CHANGELOG.md with context related to this Pull Request.

Made with Cursor