fix(wallet): tolerate client clock skew in credential expiry checks

[noevidence1017]

Summary

Audits and hardens clock-skew handling for time-bound credentials in __check_auth.

Session-key (SessionKeyAcl::expiry) and allowance (Allowance::expiry) expiry were compared against the consensus ledger timestamp with a strict now > expiry. Clients choose that expiry from their local wall clock and, for ledger-bound lifetimes, an assumed ledger rate (~5 s/ledger). Local clock drift and ledger-rate rounding can therefore place the stored expiry a few seconds earlier than the user expects, producing spurious SessionKeyExpired / AllowanceExpired rejections right at the boundary.

Behaviour (documented)

• The on-chain comparison uses env.ledger().timestamp(), which is part of consensus and identical for every validator in a given ledger. There is no validator-side skew, so a strict comparison is correct on the contract side.
• The skew to defend against is entirely client-side (clock drift + ledger-rate estimation when picking the expiry value).
• Fix: a small, fixed grace window, CLOCK_SKEW_TOLERANCE_SECS = 60, applied to every expiry comparison. The grace window only ever extends validity, by a bounded constant, so it cannot cause an unexpired credential to be rejected and cannot weaken any check other than expiry.

Changes

• New module contracts/invisible_wallet/src/auth/expiration.rs centralising expiry logic:
  • is_expired(now, expiry) — tolerance-aware, with saturating add for overflow safety.
  • is_expired_strict(now, expiry) — exact boundary, for tests/docs.
  • ensure_not_expired(now, expiry, err) — Result helper letting each caller surface its own error variant.
• session_key::enforce and the allowance check in __check_auth now route through this module instead of inline now > expiry.
• Module-level documentation explaining the ledger-timestamp semantics and the rationale for the grace window.

Tests

• Unit tests for boundary timestamps: before expiry, exactly at expiry, one second past expiry (within grace), edge of grace window, one second past grace, far past, plus u64::MAX overflow safety and zero-expiry cases.
• End-to-end boundary tests through session_key::enforce (at expiry, within grace, past grace).
• Full suite passes: cargo test -p invisible-wallet → 62 passed; 0 failed.

Closes #365

[vercel]

@noevidence1017 is attempting to deploy a commit to the miracle656's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@noevidence1017 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits