Function TestHandleCreateAPIKey_RejectsMalformedExpiresAt

internal/auth/auth_test.go:260–270

TestHandleCreateAPIKey_RejectsMalformedExpiresAt: not-RFC-3339 → 400, not "silently fall back to NULL." The handler chooses to fail loudly because misformed input is a real client bug worth surfacing.

(t *testing.T)

// 400, not "silently fall back to NULL." The handler chooses to fail
// loudly because misformed input is a real client bug worth surfacing.
func TestHandleCreateAPIKey_RejectsMalformedExpiresAt(t *testing.T) {
	ua, _, token := setupUserAuth(t)

	req := authedJSON("POST", "/api/keys", token, `{"name":"bad","expires_at":"next-tuesday"}`)
	w := httptest.NewRecorder()
	ua.HandleCreateAPIKey(w, req)

	if w.Code != http.StatusBadRequest {
		t.Errorf("status = %d, want 400; body=%s", w.Code, w.Body.String())
	}
}

// --- PATCH /api/auth/me (Item #8) ---