From 7512e5862fc99771be3b778627708b26b6396709 Mon Sep 17 00:00:00 2001 From: gcoinstash-cmd Date: Sat, 5 Sep 2026 01:51:38 -0700 Subject: [PATCH] test(validation): add snap token TTL validation and permission cache key generator assertions --- internal/validation/wave6_token_cache_test.go | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 internal/validation/wave6_token_cache_test.go diff --git a/internal/validation/wave6_token_cache_test.go b/internal/validation/wave6_token_cache_test.go new file mode 100644 index 000000000..3d2f1800e --- /dev/null +++ b/internal/validation/wave6_token_cache_test.go @@ -0,0 +1,36 @@ +package validation + +import ( + "testing" +) + +func TestWave6SnapTokenTTLValidation(t *testing.T) { + isSnapTokenValid := func(issuedAt int64, ttlSeconds int64, currentTs int64) bool { + return (currentTs - issuedAt) <= ttlSeconds && currentTs >= issuedAt + } + + now := int64(1788500000) + ttl := int64(300) // 5 minutes + + if !isSnapTokenValid(now-100, ttl, now) { + t.Error("token within TTL should be valid") + } + if isSnapTokenValid(now-301, ttl, now) { + t.Error("token exceeding TTL should be expired") + } + if isSnapTokenValid(now+100, ttl, now) { + t.Error("token with future timestamp should be rejected") + } +} + +func TestWave6PermissionCacheKeyGenerator(t *testing.T) { + generateCacheKey := func(tenantID string, entityType string, entityID string, permission string) string { + return tenantID + "#" + entityType + ":" + entityID + "@" + permission + } + + key := generateCacheKey("t_123", "organization", "456", "admin") + expected := "t_123#organization:456@admin" + if key != expected { + t.Errorf("generateCacheKey = %q; want %q", key, expected) + } +}