Codex first iteration

internal/auth/service_test.go

@@ -0,0 +1,37 @@
+package auth
+
+import (
+	"testing"
+	"time"
+)
+
+func TestSessionsAndRotation(t *testing.T) {
+	s := New("1234", "9876", string(make([]byte, 32)), time.Hour, false)
+	c, err := s.Authenticate(Student, "1234", "ip")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.SessionID == "" || c.CSRFToken == "" {
+		t.Fatal("missing random claims")
+	}
+	raw := s.Sign(c)
+	got, err := s.Parse(raw)
+	if err != nil || got.Role != Student {
+		t.Fatalf("parse: %#v %v", got, err)
+	}
+	rotated := New("4321", "9876", string(make([]byte, 32)), time.Hour, false)
+	if _, err := rotated.Parse(raw); err == nil {
+		t.Fatal("PIN rotation did not invalidate session")
+	}
+}
+func TestWrongPINAndExpiry(t *testing.T) {
+	s := New("1234", "9876", string(make([]byte, 32)), time.Hour, false)
+	if _, err := s.Authenticate(Instructor, "bad", "ip"); err == nil {
+		t.Fatal("wrong PIN accepted")
+	}
+	c, _ := s.Authenticate(Student, "1234", "another")
+	c.ExpiresAt = time.Now().Add(-time.Second).Unix()
+	if _, err := s.Parse(s.Sign(c)); err == nil {
+		t.Fatal("expired session accepted")
+	}
+}