fix(ack-pay): enforce payment request expiresAt

[MrFaruk0]

PaymentRequest.expiresAt is documented as the point after which a payment request becomes invalid, but verifyPaymentRequestToken only enforced the standard JWT exp claim.

Payment requests created through ACK-Pay carry expiresAt in the JWT payload without an exp claim, so a validly signed request with a past expiresAt was still accepted by the default verification path.

Fix: after parsing the payment request, reject it when expiresAt has passed and expiry verification is enabled. verifyExpiry: false continues to skip expiry checks, preserving the existing receipt-verification behavior where receipts may outlive the payment request.

Tests: added regression coverage for past and future expiresAt values, verifyExpiry: false, and verifying a receipt over an expired payment request.

Changeset: added (@agentcommercekit/ack-pay, patch).

Related to #120, but non-overlapping: that PR validates and normalizes expiresAt values at the schema level; this change enforces the parsed timestamp during verification.

Verified locally: @agentcommercekit/ack-pay tests (38/38), package build, oxlint, oxfmt --check, and git diff --check.

---

AI usage disclosure (per AI_POLICY.md): this fix was developed with AI assistance (Codex - GPT 5.6 Sol). I reviewed the final diff and understand the change.

Summary by CodeRabbit

• New Features
  • Added expiration validation for payment requests when expiry verification is enabled.
  • Expired payment requests are rejected, while future-dated requests are accepted.
  • Expiry checks can be disabled when needed.
  • Payment receipts referencing expired requests continue to validate successfully.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7b9d2cec-5425-4021-b8d8-4b24b08fd1a4

📥 Commits

Reviewing files that changed from the base of the PR and between 0b8fdaa and b0b61c5.

📒 Files selected for processing (4)

• .changeset/ack-pay-expires-at-verification.md
• packages/ack-pay/src/verify-payment-receipt.test.ts
• packages/ack-pay/src/verify-payment-request-token.test.ts
• packages/ack-pay/src/verify-payment-request-token.ts

---

Walkthrough

Payment request token verification now validates expiresAt when verifyExpiry is enabled. Tests cover expired, future, and disabled verification cases. Receipt verification remains successful for expired requests, and a patch changeset documents the behavior.

Changes

Payment request expiry verification

Layer / File(s)	Summary
PaymentRequest expiry validation packages/ack-pay/src/verify-payment-request-token.ts	verifyExpiry now covers JWT exp and PaymentRequest expiresAt. Expired requests throw InvalidPaymentRequestTokenError.
Token expiry behavior tests packages/ack-pay/src/verify-payment-request-token.test.ts	Tests cover expired requests, future-dated requests, and expired requests with expiry verification disabled.
Receipt verification coverage packages/ack-pay/src/verify-payment-receipt.test.ts, .changeset/ack-pay-expires-at-verification.md	Tests verify receipts linked to expired payment requests. The changeset documents the expiry rejection behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b0b61

The change adds enforcement for expired payment requests while preserving receipt verification behavior when expiry checks are disabled; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: venables

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes enforcement of the payment request expiresAt field, which is the main change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}