{"record":{"id":"96aa33f362dbb819","repo":"nautechsystems/nautilus_trader","slug":"system-clock-is-before-unix-epoch","errorCode":null,"errorMessage":"system clock is before UNIX epoch","messagePattern":"system clock is before UNIX epoch","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/adapters/lighter/src/signing/auth_token.rs","lineNumber":121,"sourceCode":"/// Mint an auth token from a [`crate::common::credential::Credential`] using\n/// the default 7-hour TTL and a fresh CSPRNG nonce.\n///\n/// The token format matches the Go reference's `ConstructAuthToken`. The\n/// returned string is the value the WebSocket subscribe handshake sends in\n/// the `auth` field of an `account_*` channel subscription.\n///\n/// # Errors\n///\n/// Returns the underlying [`crate::common::credential::Credential::private_key`]\n/// failure if the secret cannot be decoded, or any [`build_auth_token`]\n/// failure (clock-before-epoch or, hypothetically, a breach caused by its own\n/// deadline validation).\npub fn build_auth_token_for(\n    credential: &crate::common::credential::Credential,\n) -> anyhow::Result<SecretString> {\n    let now = SystemTime::now()\n        .duration_since(UNIX_EPOCH)\n        .map_err(|_| anyhow::anyhow!(\"system clock is before UNIX epoch\"))?\n        .as_secs();\n    let now_i64 = i64::try_from(now)\n        .map_err(|_| anyhow::anyhow!(\"system clock overflowed when converting to i64\"))?;\n    let deadline = now_i64\n        .checked_add(DEFAULT_AUTH_TOKEN_TTL_SECS)\n        .ok_or_else(|| anyhow::anyhow!(\"deadline computation overflowed\"))?;\n    let sk = credential.private_key()?;\n    build_auth_token(\n        deadline,\n        credential.account_index(),\n        credential.api_key_index(),\n        &sk,\n        fresh_k(),\n    )\n    .map_err(|e| anyhow::anyhow!(\"failed to mint Lighter auth token: {e}\"))\n}\n\n/// Draws a fresh canonical [`Scalar`] from the thread-local CSPRNG suitable","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/lighter/src/signing/auth_token.rs#L103-L139","documentation":"build_auth_token_for timestamps the auth token with the current system time. If SystemTime::now() is before the UNIX epoch — only possible on systems with a clock set earlier than 1970-01-01 — duration_since(UNIX_EPOCH) fails and this error is raised instead of producing a token with a bogus/negative timestamp.","triggerScenarios":"Calling any authenticated flow (apply_referral_attribution, is_maker_only_api_key, WS consumer spawn, order status reports, fill report pagination) on a machine whose system clock is set before 1970-01-01.","commonSituations":"Fresh embedded boards/VMs without RTC and unsynced clocks; containers with wrong system time after host suspend; misconfigured timezones/time manually set far in the past.","solutions":["Synchronize the system clock (NTP: `chronyc makestep`, `ntpdate`, or systemd-timesyncd) and retry.","Check `date -u` — if it shows a pre-1970 date, fix the OS/hypervisor clock configuration.","In containers/VMs, restart the host clock sync or resync after suspend/resume.","Ensure the process is not chrooted into an environment with a fabricated clock."],"exampleFix":"// host shell\n$ date -u  # shows e.g. 1969-12-31\n$ sudo systemctl enable --now systemd-timesyncd\n$ sudo chronyc -a makestep\n$ date -u  # now current; retry the client","handlingStrategy":"validation","validationCode":"// Guard before calling authenticated APIs\nlet now = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)\n    .map_err(|_| anyhow!(\"fix system clock before authenticating\"))?;","typeGuard":null,"tryCatchPattern":"match build_auth_token_for(&credential) {\n    Ok(token) => token,\n    Err(e) if e.to_string().contains(\"before UNIX epoch\") => {\n        eprintln!(\"system clock is wrong; enable NTP and retry\");\n        std::process::exit(1);\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Run NTP/chrony or systemd-timesyncd on hosts running the client.","Check clock correctness at process startup and fail fast.","In VMs/containers, ensure host clock sync after suspend/resume."],"tags":["rust","clock","time","auth-token"],"backgroundTag":"invalid-system-clock","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}