test: add token expiry validator tests

Author: yugomania

src/constants/error.constants.ts

@@ -15,6 +15,8 @@ export const ErrorCode = {
    JWT_ERROR: 'TOKEN_ERROR',
    INSUFFICIENT_BALANCE: 'insufficient_balance',
    NOT_A_CREATOR: 'not_a_creator',
+   TOKEN_EXPIRY_TAMPERED: 'token_expiry_tampered',
+   MISSING_IAT: 'missing_iat',
 } as const;
 
 export type ErrorCodeType = (typeof ErrorCode)[keyof typeof ErrorCode];

src/utils/token-expiry.validator.test.ts

@@ -0,0 +1,53 @@
+import { validateTokenExpiry } from '../utils/token-expiry.validator';
+
+describe('validateTokenExpiry', () => {
+   it('accepts a token where exp === iat + ttl', () => {
+      const payload = {
+         iat: 1000,
+         exp: 1060,
+         ttlSeconds: 60,
+      };
+
+      const result = validateTokenExpiry(payload);
+
+      expect(result.valid).toBe(true);
+   });
+
+   it('rejects a token where exp > iat + ttl with token_expiry_tampered', () => {
+      const payload = {
+         iat: 1000,
+         exp: 1100,
+         ttlSeconds: 60,
+      };
+
+      const result = validateTokenExpiry(payload);
+
+      expect(result.valid).toBe(false);
+      expect(result.code).toBe('token_expiry_tampered');
+   });
+
+   it('rejects a token where exp < iat + ttl with token_expiry_tampered', () => {
+      const payload = {
+         iat: 1000,
+         exp: 1050,
+         ttlSeconds: 60,
+      };
+
+      const result = validateTokenExpiry(payload);
+
+      expect(result.valid).toBe(false);
+      expect(result.code).toBe('token_expiry_tampered');
+   });
+
+   it('rejects a token with no iat claim with missing_iat', () => {
+      const payload = {
+         exp: 1100,
+         ttlSeconds: 60,
+      };
+
+      const result = validateTokenExpiry(payload);
+
+      expect(result.valid).toBe(false);
+      expect(result.code).toBe('missing_iat');
+   });
+});

src/utils/token-expiry.validator.ts

@@ -0,0 +1,35 @@
+/**
+ * Token expiry validator.
+ *
+ * Computes the expected expiry as iat + ttlSeconds and validates that
+ * the token's exp claim matches. Returns specific error codes for
+ * tampered expiry or missing iat claim.
+ */
+export interface TokenExpiryValidationResult {
+   valid: boolean;
+   code?: string;
+}
+
+export function validateTokenExpiry(
+   payload: { iat?: number; exp: number; ttlSeconds: number }
+): TokenExpiryValidationResult {
+   if (payload.iat === undefined) {
+      return { valid: false, code: 'missing_iat' };
+   }
+
+   const expectedExp = payload.iat + payload.ttlSeconds;
+
+   if (payload.exp === expectedExp) {
+      return { valid: true };
+   }
+
+   if (payload.exp > expectedExp) {
+      return { valid: false, code: 'token_expiry_tampered' };
+   }
+
+   if (payload.exp < expectedExp) {
+      return { valid: false, code: 'token_expiry_tampered' };
+   }
+
+   return { valid: false };
+}