fix(auth): require exp claim when verifying access tokens

[SashaMIT]

Problem

APIKeyTokenVerifier.Verify parses with WithValidMethods / WithIssuer / WithLeeway but not WithExpirationRequired. Under golang-jwt v5, a token carrying no exp claim at all passes validation and never expires.

First-party SDKs always set exp (the Go SDK unconditionally defaults it in ToJWT), so this doesn't affect well-behaved minters — but any hand-rolled or third-party minter that forgets exp silently mints a permanent credential, and the server accepts it without complaint.

Fix

Add jwt.WithExpirationRequired() to the parse options. One line; tokens with a valid exp are unaffected.

Tests

Added token without exp is rejected to TestVerifier, using a hand-rolled jwt.MapClaims token (the Go SDK always sets exp, so the case has to be built directly). go test ./auth/ passes.

Made with Cursor

Made with Cursor

[changeset-bot]

⚠️ No Changeset found

Latest commit: 04ed682

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR