From c379fd43a913cf96b0ff6c917ba36458ff57138b Mon Sep 17 00:00:00 2001
From: Pratyoy Mukhopadhyay <35388175+pmmukh@users.noreply.github.com>
Date: Tue, 24 Aug 2021 19:06:40 -0700
Subject: [PATCH] [MAR-3131] Set grace to 0 on non-positive lease duration
 (#12372)

* [MAR-3131] Set grace to 0 on non-positive lease duration

* [MAR-3131] Add changelog

* [VAULT-3131] Add test for negative lease duration
---
 api/lifetime_watcher.go |  2 +-
 api/renewer_test.go     | 11 +++++++++++
 changelog/12372.txt     |  3 +++
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 changelog/12372.txt

diff --git a/api/lifetime_watcher.go b/api/lifetime_watcher.go
index bcb46cf34..b1d81332f 100644
--- a/api/lifetime_watcher.go
+++ b/api/lifetime_watcher.go
@@ -377,7 +377,7 @@ func (r *LifetimeWatcher) doRenewWithOptions(tokenMode bool, nonRenewable bool,
 // assumptions given the total lease time; it also adds some jitter to not have
 // clients be in sync.
 func (r *LifetimeWatcher) calculateGrace(leaseDuration time.Duration) {
-	if leaseDuration == 0 {
+	if leaseDuration <= 0 {
 		r.grace = 0
 		return
 	}
diff --git a/api/renewer_test.go b/api/renewer_test.go
index eb28981a4..6289b2fd5 100644
--- a/api/renewer_test.go
+++ b/api/renewer_test.go
@@ -149,6 +149,17 @@ func TestLifetimeWatcher(t *testing.T) {
 			nil,
 			false,
 		},
+		{
+			15 * time.Second,
+			"negative_lease_duration",
+			-15,
+			15,
+			func(_ string, _ int) (*Secret, error) {
+				return renewedSecret, nil
+			},
+			nil,
+			true,
+		},
 	}
 
 	for _, tc := range cases {
diff --git a/changelog/12372.txt b/changelog/12372.txt
new file mode 100644
index 000000000..22a64c921
--- /dev/null
+++ b/changelog/12372.txt
@@ -0,0 +1,3 @@
+```release-note: bug
+core/api: Fix an arm64 bug converting a negative int to an unsigned int
+```
\ No newline at end of file