add ability to issue tokens with no expiry

token.go

@@ -21,13 +21,16 @@ type Token struct {
 // newToken builds a Token from a decoded payload. Package-private —
 // only the Issuer constructs Tokens, after successful validation.
 func newToken(p payload) *Token {
-	return &Token{
+	t := &Token{
 		id:          p.ID,
 		issuedAt:    time.Unix(p.Iat, 0),
-		expiresAt:   time.Unix(p.Exp, 0),
 		permissions: p.Permissions,
 		data:        p.Data,
 	}
+	if p.Exp != 0 {
+		t.expiresAt = time.Unix(p.Exp, 0)
+	}
+	return t
 }
 
 // ID returns the unique token identifier (used by the revocation store).
@@ -36,9 +39,13 @@ func (t *Token) ID() string { return t.id }
 // IssuedAt returns when the token was issued.
 func (t *Token) IssuedAt() time.Time { return t.issuedAt }
 
-// ExpiresAt returns when the token expires.
+// ExpiresAt returns when the token expires. Returns the zero time.Time
+// if the token was issued with NoExpiry; check NeverExpires before use.
 func (t *Token) ExpiresAt() time.Time { return t.expiresAt }
 
+// NeverExpires reports whether the token was issued without an expiry.
+func (t *Token) NeverExpires() bool { return t.expiresAt.IsZero() }
+
 // Permissions returns a copy of the token's permission strings.
 // The returned slice is safe to retain and modify.
 func (t *Token) Permissions() []string {