Evaluate token lifetimes against the current time by default

[djw8605]

Problem

Validator captures std::chrono::system_clock::now() at construction and uses that frozen instant (via FixedClock) to evaluate exp/nbf on every subsequent verification.

Validators and Enforcers are commonly constructed once and reused for the lifetime of a server process. Unless the caller remembers to call validator_set_time/enforcer_set_time before every use, a long-lived Enforcer:

• accepts tokens that expired hours or days ago (any token valid at enforcer-construction time stays valid forever), and
• rejects fresh tokens whose nbf is after the enforcer was created.

The first is a security issue: token expiration is the primary revocation mechanism in this ecosystem.

Fix

Sample the clock at each verification unless the caller explicitly pinned it with set_now() (tracked by a new m_now_set flag). The documented "validate as if at some time in the past" feature (validator_set_time/enforcer_set_time) is fully preserved — the existing ExplicitTime test covers it.

Behavior change

Callers who relied on the frozen construction-time clock (without calling set_time) will now see expired tokens correctly rejected. That is the safer default; flagging it here explicitly since it is technically observable.

Testing

• ctest unit, env_config, and monitoring suites pass, including SerializeTest.ExplicitTime (pinned-clock path) and the expired-token rejection tests.

🤖 Generated with Claude Code