fix: cap expires in and return bad request

[ferhatelmas]

What kind of change does this PR introduce?

fix

What is the current behavior?

Schema only validates the type for expiresIn but doesn't cap the max value so invalid value can bubble as 500 while signing.

What is the new behavior?

Cap the value by safe range and bubble it as 400 invalid parameter

[Copilot]

Pull request overview

This PR prevents oversized expiresIn values from causing internal signing failures by bounding/validating the parameter and returning a client-facing 400 error instead of a 500 during JWT signing for signed object URLs.

Changes:

• Add a maximum constraint for expiresIn in the signed URL and batch signed URL request schemas.
• Harden JWT signing by validating numeric expirations and converting jose expiration-setting failures into InvalidParameter (400).
• Add tests to assert oversized expiresIn is rejected for single/batch signed URL routes and for signJWT().

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/internal/auth/jwt.ts	Adds MAX bound constant and validates/guards expiration handling in signJWT.
src/http/routes/object/getSignedURL.ts	Caps expiresIn in the single signed URL route body schema.
src/http/routes/object/getSignedURLs.ts	Caps expiresIn in the batch signed URLs route body schema.
src/test/jwt.test.ts	Adds coverage ensuring signJWT() rejects oversized numeric expirations as InvalidParameter.
src/test/object.test.ts	Adds route-level coverage ensuring oversized expiresIn is rejected before signing (single + batch).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coveralls]

Coverage Report for CI Build 24459457204

Coverage increased (+60.4%) to 82.475%

Details

• Coverage increased (+60.4%) from the base build.
• Patch coverage: 2 uncovered changes across 1 file (49 of 51 lines covered, 96.08%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
src/internal/auth/jwt.ts	37	35	94.59%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	33991
Covered Lines:	30504
Line Coverage:	89.74%
Relevant Branches:	7463
Covered Branches:	3685
Branch Coverage:	49.38%
Branches in Coverage %:	Yes
Coverage Strength:	348.96 hits per line

---

💛 - Coveralls

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.