audit: normalise timestamps to UTC across auth + cluster (follow-up to PR #459)

[xe-nvdk]

Background

PR #459 (Phase A.2 Item 2) fixed a UTC drift in the RBAC FSM apply path: nextProposerTimestamp() on the proposer side and every time.Unix(0, entry.{Created,Updated}AtUnixNano) in internal/auth/cluster_rbac_apply.go now use .UTC() so SQLite text-encoded created_at values round-trip byte-identically under the WHERE created_at = ? readback in CreateRole / CreateMeasurementPermission.

That fix was narrowly scoped to RBAC. The same shape exists elsewhere in the codebase and should be audited.

Scope

Confirmed-needs-audit sites

The Phase A token applier path uses the same time.Unix(0, ...) shape without .UTC():

• internal/auth/cluster_apply.go:132 — createdAt := time.Unix(0, entry.CreatedAtUnixNano)
• internal/auth/cluster_apply.go:135 — expiresAt = time.Unix(0, entry.ExpiresAtUnixNano)
• internal/auth/cluster_apply.go:204 — expiresAt = time.Unix(0, entry.ExpiresAtUnixNano)

There is no current WHERE created_at = ? or WHERE expires_at = ? equality readback paired with these inserts, so it doesn't round-trip-break today — but it's the same latent bug shape that bit PR #459, and any future readback added against these columns would inherit the timezone-mismatch risk.

Broader audit (lower priority)

Walk the codebase for proposer/applier-side timestamp pairs that pass through SQLite text serialisation:

1. Grep for time.Unix(0, and time.Now() in internal/auth/, internal/cluster/raft/, internal/database/, internal/audit/, and anywhere else timestamps land in SQLite.
2. For each site that inserts a time.Time into SQLite, confirm whether any read path uses WHERE <col> = ? equality. If yes, both sides must be UTC.
3. For sites that only insert and never equality-match, normalise to UTC anyway for log/metric/diagnostic consistency.

Suggested approach

• Add .UTC() to all time.Unix(0, ...) sites in internal/auth/cluster_apply.go (3 sites confirmed above) as a no-behaviour-change defensive normalisation.
• Run a broader grep + reviewer-agent sweep to enumerate every timestamp insert/readback pair across the auth, audit, and cluster packages.
• Add a unit test (or extend an existing one) that runs with TZ=America/Argentina/Buenos_Aires set, exercising every Create/Update/Delete RBAC + token path. A round-trip-UTC bug only manifests in non-UTC environments; CI normally runs UTC so we won't catch regressions otherwise.

Why this should be tracked separately

PR #459's scope was the cascade-on-delete soft cap. The UTC fix landed inside that PR because Gemini's High finding on nextProposerTimestamp exposed it. Doing the broader sweep in the same PR would expand the diff well past Item 2's scope and make review harder. Better as its own focused PR.

References

• PR feat(cluster-auth): Phase A.2 Item 2 — cascade-on-delete soft cap #459 — original fix scope: feat(cluster-auth): Phase A.2 Item 2 — cascade-on-delete soft cap #459
• Gemini High finding that triggered the audit: feat(cluster-auth): Phase A.2 Item 2 — cascade-on-delete soft cap #459 (comment)
• feedback_utc_must_match_on_both_sides_of_readback memory entry (project convention)

Acceptance criteria

• All 3 confirmed time.Unix(0, ...) sites in internal/auth/cluster_apply.go normalised to .UTC().
• Codebase grepped for other time.Unix(0, ...) + time.Now() sites that land in SQLite; each documented as "audited, UTC-safe" or "fixed".
• CI runs at least one test under a non-UTC TZ to catch regressions.

[xe-nvdk]

Closed — 2026-05-26T00:01Z

Merged via PR #461, squash commit ac1278f on main.

What landed

11 timestamp sites normalised to UTC:

• internal/auth/cluster_apply.go (3 sites) — Phase A token FSM applier
• internal/auth/rbac_manager.go (7 sites) — RBAC OSS direct-SQLite path
• internal/tiering/migrator.go (1 site) — MigrateFile.startTime

3 regression tests (each verified to catch a re-introduced bug by temp-revert experiment):

• TestProposer_CreateRole_NonUTCRoundTrip — RBAC cluster proposer/applier UTC parity
• TestOSS_RBACWrites_StampUTC — OSS-path RBAC Create/Update location assertions
• TestApply_TokenCreate_NonUTC — Phase A token applier raw-text SQLite assertion

All tests run under TZ=America/Argentina/Buenos_Aires via time.Local mutation with proper t.Cleanup ordering. Skip gracefully on Alpine without tzdata.

Acceptance criteria

• All 3 confirmed time.Unix(0, ...) sites in internal/auth/cluster_apply.go normalised to .UTC().
• Codebase grepped for other time.Unix(0, ...) + time.Now() sites that land in SQLite; each documented as "audited, UTC-safe" or "fixed". (Full audit table generated by an Explore agent; 7 OSS-path RBAC sites discovered beyond the 4 originally flagged.)
• CI runs at least one test under a non-UTC TZ to catch regressions. (Three tests force time.Local; all run on every CI invocation.)

Review

1 Gemini round, 1 Medium (test-quality bug — got != nil && guard silently skipped the assertion on a readback failure), accepted. 1 internal review pass with configuration matrix + deep reviewer agent; 2 Mediums + 1 Style nit caught and addressed before opening.