1 files changed, 27 insertions, 0 deletions
diff --git a/internal/controlplane/passkeys_test.go b/internal/controlplane/passkeys_test.go
new file mode 100644
index 0000000..8162133
--- /dev/null
+++ b/internal/controlplane/passkeys_test.go
@@ -0,0 +1,27 @@
+package controlplane
+
+import (
+	"testing"
+	"time"
+
+	"github.com/go-webauthn/webauthn/webauthn"
+)
+
+func TestEnsureWebAuthnExpirySetsServerSideDeadline(t *testing.T) {
+	before := time.Now().UTC()
+	session := &webauthn.SessionData{}
+	ensureWebAuthnExpiry(session)
+	if session.Expires.Before(before.Add(webAuthnChallengeTTL-time.Second)) ||
+		session.Expires.After(time.Now().UTC().Add(webAuthnChallengeTTL+time.Second)) {
+		t.Fatalf("expiry %s is not approximately %s from now", session.Expires, webAuthnChallengeTTL)
+	}
+}
+
+func TestEnsureWebAuthnExpiryPreservesLibraryDeadline(t *testing.T) {
+	want := time.Now().UTC().Add(time.Minute)
+	session := &webauthn.SessionData{Expires: want}
+	ensureWebAuthnExpiry(session)
+	if !session.Expires.Equal(want) {
+		t.Fatalf("expiry = %s, want %s", session.Expires, want)
+	}
+}