Expire access at the deadline

A grant that expires at 15 still authorizes a request at time 15. Trace the access check and active-grant listing. Restore the same expiry rule in both paths. A teammate proposes the patch below. Review it against the full application contract, including unchanged code. Decide whether it is complete and safe to merge.

Review focus: API Contract Debugging

src/domain/grants.py

BeforeProposed

+1−1

2727 allowed = request['status'] == 'active'

2828 allowed = allowed and command['actor'] == request['applicant']

2929 allowed = allowed and command['scope'] in request['scopes']

30 allowed = allowed and now <= request['expiresAt'] if allowed else False

30 allowed = allowed and now < request['expiresAt'] if allowed else False

3131 return {'allowed': allowed}

3232

3333def listing(state, command):

Your review

0 / 10,000 characters · A verdict needs supporting evidence.

30 more characters to give a verdict