rbac and licenses

src/services/vaultifyManager.js

@@ -75,26 +75,40 @@ class VaultifyManager {
   // =========================================================
 
   verify(record) {
-
     try {
+      const payload = this.parsePayload(record.Payload);
+
       const data = {
         Customer_ID: record.Customer_ID,
         Feature: record.Feature,
-        Payload: this.parsePayload(record.Payload),
-        ExpiresAt: record.ExpiresAt
+        Payload: payload,
+        ExpiresAt: record.ExpiresAt ?? null
       };
 
       const verifier = crypto.createVerify('RSA-SHA256');
-
       verifier.update(JSON.stringify(data));
       verifier.end();
 
-      return verifier.verify(
+      const isValid = verifier.verify(
         this.publicKey,
         record.Signature,
         'base64'
       );
 
+      if (!isValid) return false;
+
+      // 🔥 WICHTIG: Ablaufdatum HIER erzwingen
+      if (payload.expiresAt && record.ExpiresAt) {
+        if (payload.expiresAt !== record.ExpiresAt) {
+          return false;
+        }
+      }
+      if (record.ExpiresAt && new Date(record.ExpiresAt) < new Date()) {
+        return false;
+      }
+
+      return true;
+
     } catch {
       return false;
     }