Summary
BearerToken#duplicate uses options[:expires_at] || @expires_at, so an explicit expires_at: nil is indistinguishable from omission. Callers cannot duplicate a token while deliberately clearing its expiration, although other duplicate options distinguish supplied values.
Proposed correction
Use options.fetch(:expires_at, @expires_at) so omission preserves the source and explicit nil clears it. Candidate: 1e7f8db539bfda5da942e406c5563c66c2fac227 on 1.17.4/current main (01431c9ecd59e1efc5d262694971ded925044fdc).
The focused model covers omitted, replaced and explicitly cleared expiration. This is distinct from PR #552's UserAuthorizer nil-expiration path. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.
I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.
Summary
BearerToken#duplicateusesoptions[:expires_at] || @expires_at, so an explicitexpires_at: nilis indistinguishable from omission. Callers cannot duplicate a token while deliberately clearing its expiration, although other duplicate options distinguish supplied values.Proposed correction
Use
options.fetch(:expires_at, @expires_at)so omission preserves the source and explicit nil clears it. Candidate:1e7f8db539bfda5da942e406c5563c66c2fac227on 1.17.4/currentmain(01431c9ecd59e1efc5d262694971ded925044fdc).The focused model covers omitted, replaced and explicitly cleared expiration. This is distinct from PR #552's
UserAuthorizernil-expiration path. The cumulative suite passes 659 RSpec examples (20 expected pending), 103 Minitest runs /201 assertions and four integration runs /41 assertions, plus RuboCop, syntax, YARD and package/install checks.I used an AI coding assistant during source review and verification. I am opening an issue first because repository policy requires tests, a changelog and a Google CLA for pull requests; this audit cannot alter repository tests and no CLA was signed as part of it.