Initial curated itworx-knowledge-hub source from 3b1751d0d9dee551aa6994eee0093704dc334817

tests/backend/ItWorx.KnowledgeHub.IntegrationTests/Auth/SessionExpiryTests.cs

@@ -0,0 +1,36 @@
+using System.Net.Http.Json;
+using ItWorx.KnowledgeHub.Contracts.Auth;
+using ItWorx.KnowledgeHub.IntegrationTests.Infrastructure;
+
+namespace ItWorx.KnowledgeHub.IntegrationTests.Auth;
+
+/// <summary>
+/// Configures a deliberately short, deterministic cookie lifetime for this test class
+/// only (see docs/22-testing-strategy.md — avoid sleeps except for a documented,
+/// bounded, real timing behavior; session expiry inherently requires elapsed time).
+/// </summary>
+[Collection(PostgresTestGroup.Name)]
+public sealed class SessionExpiryTests : OwnerSetupTestBase
+{
+    public SessionExpiryTests(PostgresContainerFixture postgres)
+        : base(postgres, new Dictionary<string, string?> { ["KnowledgeHub:Auth:CookieExpireSeconds"] = "2" })
+    {
+    }
+
+    [Fact]
+    public async Task Session_cookie_expires_after_the_configured_lifetime()
+    {
+        using var client = Factory.CreateClient();
+        await SetupHelper.LoginAsync(client, OwnerEmail, OwnerPassword);
+
+        var immediately = await client.GetFromJsonAsync<SessionResponse>("/api/v1/auth/session");
+        Assert.NotNull(immediately);
+        Assert.True(immediately.Authenticated);
+
+        await Task.Delay(TimeSpan.FromSeconds(3));
+
+        var afterExpiry = await client.GetFromJsonAsync<SessionResponse>("/api/v1/auth/session");
+        Assert.NotNull(afterExpiry);
+        Assert.False(afterExpiry.Authenticated);
+    }
+}