Add Key deprecation policy.

src/endpoints/IKeyItem.ts

@@ -16,6 +16,8 @@ export interface IKeyItem extends JsonWebKeyEdDSAPublic {
   receipt?: string;
   id?: number;
   d?: string;
+  creationDate?: string;
+  expiryDate?: string;
 }
 
 // Define an interface for a wrap key

src/endpoints/keyEndpoint.ts

@@ -14,6 +14,8 @@ import { validateAttestation } from "../attestation/AttestationValidation";
 import { hpkeKeyIdMap, hpkeKeysMap } from "../repositories/Maps";
 import { ServiceRequest } from "../utils/ServiceRequest";
 import { Logger } from "../utils/Logger";
+import { Settings } from "../policies/Settings";
+import { TrustedTime } from "../utils/TrustedTime";
 
 // Enable the endpoint
 enableEndpoint();
@@ -164,6 +166,30 @@ export const key = (
       404,
     );
   }
+
+  const settings = Settings.loadSettings().settings;
+  const gracePeriodDays = settings.keyRotation.gracePeriodDays;
+
+  // Get the current time using TrustedTime
+  const currentTime = TrustedTime.getCurrentTime();
+  const currentDate = new Date(currentTime);
+
+  // Get the expiry date of the key
+  const expiryDate = new Date(keyItem.expiryDate!);
+
+  // Calculate the grace period start date by subtracting the grace period days from the expiry date
+  const gracePeriodMillis = gracePeriodDays * 24 * 60 * 60 * 1000;
+  const gracePeriodStartDate = new Date(expiryDate.getTime() - gracePeriodMillis);
+
+  if (currentDate > expiryDate) {
+    return ServiceResult.Failed<string>(
+      { errorMessage: `${name}: Key has expired and is no longer valid` },
+      400,
+    );
+  } else if (currentDate > gracePeriodStartDate) {
+    Logger.warn(`${name}: Key is deprecated and will expire soon`);
+  }
+
   const receipt = hpkeKeysMap.receipt(kid);
 
   if (validateAttestationResult.statusCode === 202) {

src/endpoints/refreshEndpoint.ts

@@ -9,6 +9,7 @@ import { KeyGeneration } from "./KeyGeneration";
 import { enableEndpoint } from "../utils/Tooling";
 import { ServiceRequest } from "../utils/ServiceRequest";
 import { Logger } from "../utils/Logger";
+import { Settings } from "../policies/Settings";
 
 // Enable the endpoint
 enableEndpoint();
@@ -37,8 +38,16 @@ export const refresh = (
     // So the current logic is to have ids rotate from 10 to 99
     const keyItem = KeyGeneration.generateKeyItem(id % 90 + 10);
 
+    const settings = Settings.loadSettings().settings;
+    const ttlDays = settings.keyRotation.ttlDays;
+    const creationDate = new Date();
+    const expiryDate = new Date(creationDate);
+    expiryDate.setDate(creationDate.getDate() + ttlDays);
+
     // Store HPKE key pair kid
     keyItem.kid = `${keyItem.kid!}_${id}`;
+    keyItem.creationDate = creationDate.toISOString();
+    keyItem.expiryDate = expiryDate.toISOString();
     hpkeKeyIdMap.storeItem(id, keyItem.kid);
 
     // Store HPKE key pair

src/utils/TrustedTime.ts

@@ -0,0 +1,12 @@
+export class TrustedTime {
+  private static lastTimestamp: number = 0;
+
+  public static getCurrentTime(): number {
+    const currentTime = Date.now();
+    if (currentTime <= this.lastTimestamp) {
+      throw new Error("System time moved backwards.");
+    }
+    this.lastTimestamp = currentTime;
+    return currentTime;
+  }
+}