Lemur: Fix API key expiration bugs

[LeedrisDev]

Summary

API keys become unusable shortly after creation, even when set to infinite validity (TTL=-1). This PR fixes four interrelated bugs in API key timestamp handling.

Bugs Fixed

Bug 1: Timezone mismatch in expiration validation (lemur/auth/service.py)

Before:

current_time = datetime.utcnow()                            # UTC naive datetime
expired_time = datetime.fromtimestamp(access_key.issued_at)  # LOCAL naive datetime

fromtimestamp() returns local time but is compared against utcnow() (UTC). On non-UTC servers, keys expire at wrong times — off by the server's timezone offset.

After:

current_time = datetime.utcnow()                               # UTC naive datetime
expired_time = datetime.utcfromtimestamp(access_key.issued_at)  # UTC naive datetime

Bug 2: Wrong epoch stored for issued_at (lemur/api_keys/views.py, cli.py)

Before:

issued_at=int(datetime.utcnow().timestamp())

datetime.utcnow() returns UTC values, but .timestamp() interprets the naive datetime as local time, storing a wrong Unix epoch on non-UTC servers.

After:

issued_at=int(time.time())

time.time() always returns the correct UTC epoch regardless of server timezone.

Note: Bugs 1 & 2 "cancel out" on a single server with stable timezone, but break across multi-server deployments with different timezones or during DST transitions.

Bug 3: CLI doesn't convert TTL to int (lemur/api_keys/cli.py)

Before:

ttl=ttl,  # string from CLI arg, e.g. "-1"

CLI arguments are strings. "-1" != -1 (string vs int), so create_token won't remove the exp claim from the JWT, causing the token to get the default 1-day expiration even for "infinite" keys created via CLI.

After:

ttl=int(ttl),

Bug 4: No TTL validation (lemur/api_keys/schemas.py)

TTL=0 would silently create an immediately-expired key. Added @validates("ttl") to all API key input schemas to reject TTL=0 and TTL < -1. Only TTL=-1 (infinite) and positive integers (days) are accepted.

Hardening: Disable PyJWT built-in exp verification (lemur/auth/service.py)

Added "verify_exp": False to jwt.decode() options since expiration is already handled manually in login_required. This prevents future PyJWT behavior changes from breaking infinite API keys (which have no exp claim in their JWT). Manual exp checking is added for regular user tokens.

Test plan

• Existing API key tests pass
• New TTL validation tests: TTL=0 → 400, TTL=-2 → 400, TTL=-1 → 200, TTL=30 → 200

[evan-datadog]

Mind also fixing line 84 so it no longer uses utcnow in setup.py ?

[LeedrisDev]

Mind also fixing line 84 so it no longer uses utcnow in setup.py ?

Done 👍