fix(cacao): reject expired and not-before timestamps

[SashaMIT]

Description

validateSignedCacao checked the signature only. It formatted exp and nbf into the CAIP-122 message, then returned true for any valid signature, including after exp, before nbf, or when those fields were unparseable.

Session authenticate in ReownSign treats that boolean as the gate (WalletKit and AppKit forward to the same method). Request-level expiryTimestamp is a different field.

Fail closed when exp is present and past or unparseable, and when nbf is present and future or unparseable. Absent timestamps stay optional, matching CAIP-122 / EIP-4361.

Language-split of WalletConnect/walletconnect-monorepo#7312, reown-com/reown-kotlin#427, reown-com/reown-rust#109, and reown-com/reown-dotnet#322. Distinct from reown-swift#345 (CR/LF) and from #413 (EIP-55 checksum in SIWE text).

Threat-model: the attacker already holds a previously valid signed CACAO. They do not control the verifier clock or the key. After exp (or before nbf) the signature is still valid, and validateSignedCacao still returned true. That is replay after expiry, not host or agent authority.

Resolves # (issue)

How Has This Been Tested?

flutter test test/auth/cacao_validity_window_test.dart test/auth/signature_test.dart

8/8 new window tests plus existing AuthSignature tests. Clock is injected (now = 1700000000). flutter analyze on the touched files is clean.

Due Diligence

• Breaking change
• Requires a documentation update

[github-actions]

All contributors have signed the CTA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[SashaMIT]

I have read the CTA Document and I hereby sign the CTA