From 197731ae2d043105ae278bf5bee435ce0c1cdad1 Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Thu, 9 Jul 2026 06:37:10 -0400
Subject: [PATCH] =?UTF-8?q?chore(auth):=20consume=20ZB.MOM.WW.Auth=200.1.4?=
 =?UTF-8?q?=20=E2=80=94=20gain=20API-key=20expiry=20enforcement=20(archrev?=
 =?UTF-8?q?iew=20G-2)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bump all four ZB.MOM.WW.Auth.* package refs 0.1.2 -> 0.1.4. The shared
ApiKeyVerifier now rejects any key whose ExpiresUtc is in the past;
existing keys have NULL expiry (never expire), so nothing breaks, and the
auth SQLite DB auto-migrates to schema v3 (nullable expires_utc column) on
first boot. Implement the two IApiKeyAdminStore members added in 0.1.3
(SetScopesAsync/SetEnabledAsync) on the test FakeApiKeyAdminStore.

Build green; no new test failures (the macOS worker-pipe IPC failures are
pre-existing/environmental, identical to the pre-bump baseline).
---
 ...B.MOM.WW.MxGateway.IntegrationTests.csproj |  4 ++--
 .../ZB.MOM.WW.MxGateway.Server.csproj         |  8 +++----
 .../DashboardSnapshotServiceTests.cs          | 21 +++++++++++++++++++
 3 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/src/ZB.MOM.WW.MxGateway.IntegrationTests/ZB.MOM.WW.MxGateway.IntegrationTests.csproj b/src/ZB.MOM.WW.MxGateway.IntegrationTests/ZB.MOM.WW.MxGateway.IntegrationTests.csproj
index e699868..06c4207 100644
--- a/src/ZB.MOM.WW.MxGateway.IntegrationTests/ZB.MOM.WW.MxGateway.IntegrationTests.csproj
+++ b/src/ZB.MOM.WW.MxGateway.IntegrationTests/ZB.MOM.WW.MxGateway.IntegrationTests.csproj
@@ -22,8 +22,8 @@
     (IntegrationTests-028).
   -->
   <ItemGroup>
-    <PackageReference Include="ZB.MOM.WW.Auth.Abstractions" Version="0.1.2" />
-    <PackageReference Include="ZB.MOM.WW.Auth.Ldap" Version="0.1.2" />
+    <PackageReference Include="ZB.MOM.WW.Auth.Abstractions" Version="0.1.4" />
+    <PackageReference Include="ZB.MOM.WW.Auth.Ldap" Version="0.1.4" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="10.0.7" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Binder" Version="10.0.7" />
   </ItemGroup>
diff --git a/src/ZB.MOM.WW.MxGateway.Server/ZB.MOM.WW.MxGateway.Server.csproj b/src/ZB.MOM.WW.MxGateway.Server/ZB.MOM.WW.MxGateway.Server.csproj
index ff87cb3..82bd3ea 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/ZB.MOM.WW.MxGateway.Server.csproj
+++ b/src/ZB.MOM.WW.MxGateway.Server/ZB.MOM.WW.MxGateway.Server.csproj
@@ -6,10 +6,10 @@
 
   <ItemGroup>
     <PackageReference Include="Grpc.AspNetCore" Version="2.76.0" />
-    <PackageReference Include="ZB.MOM.WW.Auth.Abstractions" Version="0.1.2" />
-    <PackageReference Include="ZB.MOM.WW.Auth.Ldap" Version="0.1.2" />
-    <PackageReference Include="ZB.MOM.WW.Auth.ApiKeys" Version="0.1.2" />
-    <PackageReference Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.1.2" />
+    <PackageReference Include="ZB.MOM.WW.Auth.Abstractions" Version="0.1.4" />
+    <PackageReference Include="ZB.MOM.WW.Auth.Ldap" Version="0.1.4" />
+    <PackageReference Include="ZB.MOM.WW.Auth.ApiKeys" Version="0.1.4" />
+    <PackageReference Include="ZB.MOM.WW.Auth.AspNetCore" Version="0.1.4" />
     <PackageReference Include="ZB.MOM.WW.Audit" Version="0.1.0" />
     <PackageReference Include="ZB.MOM.WW.Theme" Version="0.3.1" />
     <PackageReference Include="ZB.MOM.WW.Configuration" Version="0.1.0" />
diff --git a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSnapshotServiceTests.cs b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSnapshotServiceTests.cs
index 50698aa..5f0e48c 100644
--- a/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSnapshotServiceTests.cs
+++ b/src/ZB.MOM.WW.MxGateway.Tests/Gateway/Dashboard/DashboardSnapshotServiceTests.cs
@@ -623,6 +623,27 @@ public sealed class DashboardSnapshotServiceTests
         {
             return Task.FromResult(false);
         }
+
+        /// <summary>Does nothing; the fake never changes scopes (added to IApiKeyAdminStore in Auth 0.1.3).</summary>
+        /// <param name="keyId">Key identifier.</param>
+        /// <param name="scopes">Replacement scope set.</param>
+        /// <param name="ct">Cancellation token.</param>
+        /// <returns><see langword="false"/>, always.</returns>
+        public Task<bool> SetScopesAsync(string keyId, IReadOnlySet<string> scopes, CancellationToken ct)
+        {
+            return Task.FromResult(false);
+        }
+
+        /// <summary>Does nothing; the fake never toggles key state (added to IApiKeyAdminStore in Auth 0.1.3).</summary>
+        /// <param name="keyId">Key identifier.</param>
+        /// <param name="enabled">Desired enabled state.</param>
+        /// <param name="whenUtc">Timestamp for the state change.</param>
+        /// <param name="ct">Cancellation token.</param>
+        /// <returns><see langword="false"/>, always.</returns>
+        public Task<bool> SetEnabledAsync(string keyId, bool enabled, DateTimeOffset whenUtc, CancellationToken ct)
+        {
+            return Task.FromResult(false);
+        }
     }
 
     private class CountingApiKeyAdminStore(params ApiKeyListItem[] records) : FakeApiKeyAdminStore