Function TestHandleCreateAPIKey_AcceptsExpiresAt

internal/auth/auth_test.go:213–239

TestHandleCreateAPIKey_AcceptsExpiresAt: POST /api/keys with a future RFC 3339 timestamp persists it on the row.

(t *testing.T)

// TestHandleCreateAPIKey_AcceptsExpiresAt: POST /api/keys with a
// future RFC 3339 timestamp persists it on the row.
func TestHandleCreateAPIKey_AcceptsExpiresAt(t *testing.T) {
	ua, store, token := setupUserAuth(t)
	ctx := context.Background()

	user, _ := store.CreateOrGetUser(ctx, "josh@test.com", "Josh", "google-sub-123")

	expiresAt := time.Now().Add(48 * time.Hour).UTC().Truncate(time.Second)
	body := `{"name":"ci","expires_at":"` + expiresAt.Format(time.RFC3339) + `"}`
	req := authedJSON("POST", "/api/keys", token, body)
	w := httptest.NewRecorder()
	ua.HandleCreateAPIKey(w, req)

	if w.Code != http.StatusCreated {
		t.Fatalf("status = %d, want 201; body=%s", w.Code, w.Body.String())
	}
	var created identity.APIKey
	json.NewDecoder(w.Body).Decode(&created)
	if created.ExpiresAt == nil || !created.ExpiresAt.Equal(expiresAt) {
		t.Errorf("created.ExpiresAt = %v, want %v", created.ExpiresAt, expiresAt)
	}

	// Round-trip through the DB to confirm it was actually persisted.
	keys, _ := store.ListAPIKeys(ctx, user.ID)
	if len(keys) != 1 || keys[0].ExpiresAt == nil || !keys[0].ExpiresAt.Equal(expiresAt) {
		t.Errorf("persisted ExpiresAt mismatch: %+v", keys)
	}
}

// TestHandleCreateAPIKey_RejectsPastExpiresAt: a past timestamp must
// be a 400 — silently swallowing it would issue a key that's already