{"record":{"id":"fc8ce1ab07ef4e04","repo":"astrid-runtime/astrid","slug":"fskit-lease-is-expired","errorCode":null,"errorMessage":"FSKit lease is expired","messagePattern":"FSKit lease is expired","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fskit/src/service.rs","lineNumber":151,"sourceCode":"    {\n        bail!(\"FSKit service mountpoint overlaps the lease resource\");\n    }\n    crate::validate_mountpoint_ancestors(&launch.mountpoint)?;\n    crate::validate_unmounted_mountpoint(&launch.mountpoint)?;\n    validate_control_path(&launch.control_path, &launch.lease.resource_path)?;\n    Ok(())\n}\n\nfn validate_lease(lease: &astrid_core::storage_filesystem::StorageMountLeaseV1) -> Result<()> {\n    if lease.lease_token.len() < 16 || lease.lease_token.len() > 4096 {\n        bail!(\"FSKit lease callback token is invalid\");\n    }\n    let now = SystemTime::now()\n        .duration_since(UNIX_EPOCH)\n        .context(\"read system clock\")?\n        .as_secs();\n    if lease.expires_at_epoch_secs < now {\n        bail!(\"FSKit lease is expired\");\n    }\n    if !lease.resource_path.is_absolute() || !lease.callback_path.is_absolute() {\n        bail!(\"FSKit lease paths must be absolute\");\n    }\n    #[cfg(target_os = \"macos\")]\n    astrid_core::fskit_socket::validate_callback_path(lease.mount_id, &lease.callback_path)\n        .map_err(anyhow::Error::msg)?;\n    #[cfg(not(target_os = \"macos\"))]\n    if lease.callback_path != lease.resource_path.join(\"control.sock\") {\n        bail!(\"FSKit callback path is not the kernel lease endpoint\");\n    }\n    platform_fs::validate_private_directory(&lease.resource_path)\n        .context(\"validate private FSKit lease resource\")?;\n    platform_fs::verify_no_redirects(&lease.resource_path)\n        .context(\"reject redirected FSKit lease resource\")?;\n    platform_fs::validate_private_file(&lease.resource_path.join(\"lease.json\"))\n        .context(\"validate private FSKit lease manifest\")?;\n    let manifest = std::fs::read(lease.resource_path.join(\"lease.json\"))","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fskit/src/service.rs#L133-L169","documentation":"validate_lease compares the lease's expires_at_epoch_secs against the current system time and rejects leases that have already expired. Leases are short-lived credentials for FSKit mounts, so an expired lease is not accepted for launch.","triggerScenarios":"validate_lease is called (via validate_launch or live_managed_callback_lease_is_accepted) with lease.expires_at_epoch_secs < now, e.g. a cached/replayed lease or a system clock set far in the future.","commonSituations":"Reusing a saved lease file after it expired; slow test runs replaying stale fixtures; machine clock skew (NTP drift or incorrect system clock making 'now' appear past expiry).","solutions":["Request a fresh lease from the kernel/provider and relaunch with it","Fix system clock synchronization (NTP) if clock skew caused the false expiry","Stop caching lease files across runs; read a newly issued lease each launch"],"exampleFix":"// before\nlet lease = std::fs::read(\"stale-lease.json\")?; // expired\n// after\nlet lease = request_fresh_lease()?; // expires_at_epoch_secs > now","handlingStrategy":"validation","validationCode":"fn lease_live(lease: &StorageMountLeaseV1) -> bool {\n    let now = std::time::SystemTime::now()\n        .duration_since(std::time::UNIX_EPOCH).unwrap().as_secs();\n    lease.expires_at_epoch_secs >= now\n}","typeGuard":null,"tryCatchPattern":"match provider.run(launch) {\n    Err(e) if e.to_string().contains(\"lease is expired\") => {\n        let launch = refresh_lease(launch)?;\n        provider.run(launch).await\n    }\n    r => r,\n}","preventionTips":["Refresh leases shortly before launch; never cache across runs","Keep NTP active to avoid clock-skew false expiries","Add expiry checks in test fixtures that replay saved leases"],"tags":["fskit","lease","expiry","time"],"backgroundTag":"jwt-token-expired","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}