Function TestAPIKey_ExpiredKeyRejectedAtAuth

internal/identity/store_test.go:316–343

TestAPIKey_ExpiredKeyRejectedAtAuth: a key whose expires_at has passed must fail GetUserByAPIKey. This is the auth-side gate that makes the expires_at column actually enforce anything.

(t *testing.T)

// passed must fail GetUserByAPIKey. This is the auth-side gate that
// makes the expires_at column actually enforce anything.
func TestAPIKey_ExpiredKeyRejectedAtAuth(t *testing.T) {
	pool := testutil.TestDB(t)
	store := identity.NewStore(pool)
	ctx := context.Background()

	user, _ := store.CreateOrGetUser(ctx, "apikey-expired@example.com", "Owner", "google-apikey-expired")

	// Issue with a future expiry, then backdate via direct SQL — Create
	// rejects past timestamps at the handler layer, but the store itself
	// doesn't validate (it's the auth gate that does the enforcement).
	future := time.Now().Add(1 * time.Hour)
	key, _ := store.CreateAPIKey(ctx, user.ID, "soon-to-expire", &future)
	if _, err := pool.Exec(ctx, `UPDATE api_keys SET expires_at = $1 WHERE id = $2`,
		time.Now().Add(-1*time.Minute), key.ID); err != nil {
		t.Fatalf("backdate: %v", err)
	}

	if _, err := store.GetUserByAPIKey(ctx, key.PlaintextKey); err == nil {
		t.Error("GetUserByAPIKey should reject expired keys; got success")
	}

	// Sanity: a key with NULL expires_at issued by the same user still
	// authenticates fine (i.e. the gate is per-row, not per-user).
	stillValid, _ := store.CreateAPIKey(ctx, user.ID, "still-valid", nil)
	if _, err := store.GetUserByAPIKey(ctx, stillValid.PlaintextKey); err != nil {
		t.Errorf("never-expiring key should still authenticate: %v", err)
	}
}

func TestCreateAndGetInboundMessage(t *testing.T) {
	pool := testutil.TestDB(t)