refactor: read session_expiry/iat as raw claims and trust the platform boundary

The signature-verified, Auth0-issued ID token has already been validated
upstream (the platform refuses to emit a malformed session_expiry), so the
SDK reads it like every other operational claim instead of running a bespoke
validator. Removes State.extract_epoch_claim and reads session_expiry/iat
with a plain .get() at both extraction sites; the None guards in the ceiling
comparison functions still deliver the absent/null "no ceiling" safe default.

Production-reachable inputs (absent/null, clean integer) are unchanged; only
unreachable malformed values change behavior, now failing closed rather than
being silently accepted.

Author: kishore7snehil

src/auth0_server_python/auth_server/server_client.py

@@ -648,8 +648,8 @@ async def complete_interactive_login(
             user_claims = UserClaims.parse_obj(user_info)
             # authlib populates `userinfo` from parsed ID token claims, so the
             # IPSIE session_expiry claim may surface here.
-            session_expires_at = State.extract_epoch_claim(user_info, "session_expiry")
-            issued_at = State.extract_epoch_claim(user_info, "iat")
+            session_expires_at = user_info.get("session_expiry")
+            issued_at = user_info.get("iat")
         elif id_token:
             # Fetch JWKS for signature verification
             jwks = await self._get_jwks_cached(origin_domain, metadata)
@@ -667,8 +667,8 @@ async def complete_interactive_login(
 
                 user_claims = UserClaims.parse_obj(claims)
                 # IPSIE session_expiry ceiling from the verified ID token.
-                session_expires_at = State.extract_epoch_claim(claims, "session_expiry")
-                issued_at = State.extract_epoch_claim(claims, "iat")
+                session_expires_at = claims.get("session_expiry")
+                issued_at = claims.get("iat")
             except ValueError as e:
                 raise ApiError("jwks_key_not_found", str(e))
             except jwt.InvalidSignatureError as e:

src/auth0_server_python/tests/test_server_client.py

@@ -4824,30 +4824,6 @@ async def _fake_fetch(self, domain):
 # =============================================================================
 
 
-def test_extract_epoch_claim_valid():
-    assert State.extract_epoch_claim({"session_expiry": 1893456000}, "session_expiry") == 1893456000
-
-
-def test_extract_epoch_claim_reused_for_iat():
-    # Same extractor/validator serves any Unix-seconds claim, e.g. iat.
-    assert State.extract_epoch_claim({"iat": 1893456000}, "iat") == 1893456000
-
-
-def test_extract_epoch_claim_absent_or_empty():
-    assert State.extract_epoch_claim(None, "session_expiry") is None
-    assert State.extract_epoch_claim({}, "session_expiry") is None
-    assert State.extract_epoch_claim({"session_expiry": None}, "session_expiry") is None
-
-
-def test_extract_epoch_claim_rejects_non_int_and_non_positive():
-    # bool is an int subclass but must be rejected
-    assert State.extract_epoch_claim({"session_expiry": True}, "session_expiry") is None
-    assert State.extract_epoch_claim({"session_expiry": "1893456000"}, "session_expiry") is None
-    assert State.extract_epoch_claim({"session_expiry": 1893456000.0}, "session_expiry") is None
-    assert State.extract_epoch_claim({"session_expiry": 0}, "session_expiry") is None
-    assert State.extract_epoch_claim({"session_expiry": -5}, "session_expiry") is None
-
-
 def test_is_session_ceiling_reached_none_never_expires():
     assert State.is_session_ceiling_reached(None) is False
 

src/auth0_server_python/utils/helpers.py

@@ -189,27 +189,6 @@ def update_state_data_for_connection_token_set(
             "connection_token_sets": connection_token_sets
         }
 
-    @classmethod
-    def extract_epoch_claim(cls, claims: Optional[dict[str, Any]], name: str) -> Optional[int]:
-        """
-        Read a Unix-seconds claim (e.g. `session_expiry`, `iat`) from decoded ID
-        token claims, or None when absent or invalid.
-
-        The value must be a positive JSON integer; non-integer or non-positive
-        values are rejected rather than trusted.
-        """
-        if not claims:
-            return None
-        value = claims.get(name)
-        if value is None:
-            return None
-        # bool is an int subclass — exclude it explicitly.
-        if isinstance(value, bool) or not isinstance(value, int):
-            return None
-        if value <= 0:
-            return None
-        return value
-
     @classmethod
     def is_session_ceiling_reached(cls, session_expires_at: Optional[int]) -> bool:
         """