Function authedJSON

internal/auth/auth_test.go:157–162

--- API key endpoints (Item #3) --- authedJSON constructs a POST/PATCH with a JSON body and session cookie. Local to auth_test so the existing authedRequest stays body-less.

(method, url, sessionToken, body string)

// authedJSON constructs a POST/PATCH with a JSON body and session cookie.
// Local to auth_test so the existing authedRequest stays body-less.
func authedJSON(method, url, sessionToken, body string) *http.Request {
	req := httptest.NewRequest(method, url, strings.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	req.AddCookie(&http.Cookie{Name: auth.SessionCookieName, Value: sessionToken})
	return req
}

// TestHandleListAPIKeys_ReturnsLastUsedAtAndExpiresAt: the dashboard
// API keys table needs both columns to render. Asserts the JSON