Read the credential expiry from the token shape the minter emits

[callumalpass]

What

storage.credential_expires_at in /internal/v1/diagnostics reported no expiry for every temporary credential. Staging and lab reported credential does not expire; their credentials expire on 2026-08-24 and 2026-08-26.

That is the most dangerous way this field could fail. None also means "permanent credential", which production legitimately uses, so the broken case is indistinguishable from the healthy one — and the field exists specifically to turn a known future outage into a warning.

Why it failed

credential_expiry treated the session token as a bare JWT. The minter emits something else, at .github/scripts/r2_temporary_credential.mjs:108:

sessionToken: Buffer.from(`jwt/${jwt}`).toString("base64")

Standard base64 of jwt/<header>.<claims>.<signature>. Splitting that on . finds no second field, so the function returned None every time.

The fix unwraps the outer encoding first and falls back to a bare JWT, so either shape decodes.

Why the test did not catch it

The existing test passed the literal string "temporary-session" as a session token. It asserted the field round-tripped through config; it exercised no decoding whatsoever. The new tests build a token in the shape the minter actually produces, and pin that an unreadable token yields no expiry rather than a wrong one.

Cross-checked independently by replaying the decode steps in Node against a token built from the minter's own encoding lines: exp recovered exactly; the old path found null.

Verification

cargo test -p mdbase-connect-hosted-provider --lib blob_store — 7 passed. fmt and clippy clean.

Found by running bin/hosted-diagnostics staging (cloud-ops) against a live provider — the first real use of the surface shipped in beta.78.

Note

This needs a release and deploy to reach production. Until then credential does not expire from the diagnostics surface is unverified for staging and lab.