Access tokens: Update tests

test/integration/api/access_tokens_test.rb

@@ -50,6 +50,18 @@ def setup
     end
   end
 
+  test 'create accepts an expiration time' do
+    access_token = FactoryBot.create(:access_token, owner: @admin, scopes: %w[account_management])
+
+    user_id = @admin.id
+    expires_at = 1.day.from_now.utc.iso8601
+    assert_difference(AccessToken.method(:count), 1) do
+      post_request(user_id, {access_token: access_token.value}, { expires_at: })
+      assert_response :created, "Not created with response body #{response.body}"
+    end
+    assert_equal expires_at, AccessToken.last!.expires_at.iso8601
+  end
+
   test 'create with provider_key can create for any user of that account' do
     FactoryBot.create(:cinstance, service: master_account.default_service, user_account: @provider)
 

test/integration/api/personal/access_tokens_test.rb

@@ -95,6 +95,15 @@ class Admin::Api::Personal::CreateAccessTokenTest < Admin::Api::Personal::Access
       end
     end
 
+    test 'POST accepts an expiration time' do
+      expires_at = 1.day.from_now.utc.iso8601
+      assert_difference @admin.access_tokens.method(:count) do
+        create_access_token(access_token: admin_access_token.value, params: access_token_params({ expires_at: }))
+        assert_response :created
+        assert_equal expires_at, JSON.parse(response.body).dig('access_token', 'expires_at')
+      end
+    end
+
     def assert_it_worked(_access_token = nil)
       assert_response :created
       created_token = AccessToken.last

test/integration/by_access_token_integration_test.rb

@@ -59,4 +59,27 @@ def test_index_with_access_token
     get admin_api_registry_policies_path(format: :json), headers: auth_headers
     assert_response :forbidden
   end
+
+  test 'the token has no expiration date' do
+      get admin_api_accounts_path(format: :xml), params: { access_token: @token.value }
+
+      assert_response :success
+    end
+
+  test 'the token has a future expiration date' do
+    token = FactoryBot.create(:access_token, owner: @user, scopes: 'account_management', expires_at: 1.day.from_now.utc.iso8601)
+
+    get admin_api_accounts_path(format: :xml), params: { access_token: token.value }
+
+    assert_response :success
+  end
+
+  test 'the token has a past expiration date' do
+    token = FactoryBot.create(:access_token, owner: @user, scopes: 'account_management')
+    token.update_columns(expires_at: 1.minute.ago)
+
+    get admin_api_accounts_path(format: :xml), params: { access_token: token.value }
+
+    assert_response :forbidden
+  end
 end

test/models/access_token_test.rb

@@ -175,6 +175,42 @@ def test_find_from_id_or_value_and_bang
     assert_equal expected_audited_changes, audit.audited_changes
   end
 
+  test 'expiration time is not mandatory' do
+    access_token = FactoryBot.build(:access_token)
+
+    assert access_token.valid?
+  end
+
+  test "expiration time can be blank" do
+    access_token = FactoryBot.build(:access_token, expires_at: '')
+
+    assert access_token.valid?
+  end
+
+  test "expiration time can be nil" do
+    access_token = FactoryBot.build(:access_token, expires_at: nil)
+
+    assert access_token.valid?
+  end
+
+  test "expiration time can't be invalid" do
+    access_token = FactoryBot.build(:access_token, expires_at: 'invalid')
+
+    assert_not access_token.valid?
+  end
+
+  test "expiration time can't be in the past" do
+    access_token = FactoryBot.build(:access_token, expires_at: 1.day.ago.utc.iso8601)
+
+    assert_not access_token.valid?
+  end
+
+  test "expiration time accepts a valid ISO 8601 datetime" do
+    access_token = FactoryBot.build(:access_token, expires_at: 1.year.from_now.utc.iso8601)
+
+    assert access_token.valid?
+  end
+
   private
 
   def assert_access_token_audit_all_data(access_token, audit)

test/unit/api_authentication/by_authentication_token_test.rb

@@ -22,7 +22,7 @@ def setup
 
   def mock_token(attributes = {})
     @params = { access_token: 'some-token' }
-    token = mock('access-token', attributes)
+    token = mock('access-token', attributes.merge(expired?: false))
     @access_tokens.expects(:find_from_value).with('some-token').returns(token)
     token
   end