Accept epoch-seconds relay expiry so valid verification is not misread

tests/test_viewer_auth.py

@@ -67,6 +67,25 @@ def test_is_verified_fails_closed_when_expiry_absent_or_unparseable() -> None:
     assert auth.is_verified() is False
 
 
+def test_is_verified_accepts_epoch_expiry() -> None:
+    # A relay expiry expressed as epoch seconds must not be misread as missing.
+    future = (datetime.now(UTC) + timedelta(hours=1)).timestamp()
+    past = (datetime.now(UTC) - timedelta(hours=1)).timestamp()
+
+    # As a numeric string (how write_auth persists it).
+    auth.write_auth(email="a@b.com", token="t", verified_at=str(future))
+    assert auth.is_verified() is True
+    auth.write_auth(email="a@b.com", token="t", verified_at=str(past))
+    assert auth.is_verified() is False
+
+    # As a raw JSON number, if a record is written that way.
+    auth.AUTH_PATH.parent.mkdir(parents=True, exist_ok=True)
+    auth.AUTH_PATH.write_text(
+        f'{{"email": "a@b.com", "token": "t", "verified_at": {future}}}', encoding="utf-8"
+    )
+    assert auth.is_verified() is True
+
+
 def test_write_auth_is_0600() -> None:
     auth.write_auth(email="a@b.com", token="t", verified_at="")
     mode = stat.S_IMODE(auth.AUTH_PATH.stat().st_mode)