feat(auth): define bounded federated token time window

[seonghobae]

Objective

Advance issue #314 with a path-disjoint temporal-verification primitive for provider-neutral JWT/OIDC adapters. Verified token claims need explicit nbf/exp semantics with caller-owned bounded clock skew, including the standards-compatible case where nbf is absent, without coupling the core authority model to a specific JWT library or IdP.

Exact test-first evidence

Protected main remains exact 55d7ae8647208e301f282350f076eeddaba61d11.

• RED test-only head fe282ba852cf4fe85097c147ca0a4e683231b08d: CI run 31456292841, Maven job 93670650175, checked out that exact SHA and failed in testCompile because FederatedTokenTimeWindow did not exist.
• GREEN head 29b6eff4646b7110db027a30817544f6242bed0c: exact-head CI 31456401077, Security Scan 31456401037, SAST Semgrep 31456401080, and fuzz 31456401052 all completed successfully. CI's Maven test, Maven merge-compatibility, and buyer-readiness jobs all succeeded; CodeRabbit status is successful; no formal reviews or unresolved inline review threads exist at the latest direct refetch.

Implemented invariant

FederatedTokenTimeWindow is a provider-neutral normalized temporal authority: expiration is required and exclusive; notBefore is optional and inclusive; server-owned bounded clock skew is explicit; malformed windows, negative skew, and missing verification inputs fail closed. An absent nbf claim does not silently invent a lower validity bound. The type does not parse or trust token text itself.

Scope

New provider-neutral temporal value object plus focused tests only. This does not parse JWTs, verify signatures, fetch discovery/JWK material, choose algorithms, map issuer/audience/roles, modify controllers, or replace the current signed-header adapter. It is path-disjoint from #343's verifier port, #364's issuer trust policy, #365's role mapping, and credential/HMAC work. Issue #314 remains open for signature/JWK/discovery/introspection, issuer/audience/algorithm enforcement, role mapping, rotation/recovery, migration, and integrated production acceptance.

Merge gate

Ready for ordinary independent review. Merge only if this unchanged exact head continues to satisfy all live required checks, zero valid unresolved findings, current protected-base expectations, and the counted approving review from an independent reviewer with write access required by repository policy. Automated checks/comments/model output are evidence, not approval.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 19 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 60b58a13-ea0d-4a93-9d24-9a77de8f4404

📥 Commits

Reviewing files that changed from the base of the PR and between 55d7ae8 and 29b6eff.

📒 Files selected for processing (2)

• src/main/java/com/clearfolio/viewer/auth/FederatedTokenTimeWindow.java
• src/test/java/com/clearfolio/viewer/auth/FederatedTokenTimeWindowTest.java

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}