Function TestHandleCreateAPIKey_RejectsPastExpiresAt

internal/auth/auth_test.go:244–255

TestHandleCreateAPIKey_RejectsPastExpiresAt: a past timestamp must be a 400 — silently swallowing it would issue a key that's already expired, which is worse UX than rejecting at create time.

(t *testing.T)

// be a 400 — silently swallowing it would issue a key that's already
// expired, which is worse UX than rejecting at create time.
func TestHandleCreateAPIKey_RejectsPastExpiresAt(t *testing.T) {
	ua, _, token := setupUserAuth(t)

	past := time.Now().Add(-1 * time.Hour).UTC().Format(time.RFC3339)
	req := authedJSON("POST", "/api/keys", token, `{"name":"backdated","expires_at":"`+past+`"}`)
	w := httptest.NewRecorder()
	ua.HandleCreateAPIKey(w, req)

	if w.Code != http.StatusBadRequest {
		t.Errorf("status = %d, want 400; body=%s", w.Code, w.Body.String())
	}
}

// TestHandleCreateAPIKey_RejectsMalformedExpiresAt: not-RFC-3339 →
// 400, not "silently fall back to NULL." The handler chooses to fail