test(auth): add agent session token expiry and clock skew validation specs

test/wave17_session_expiry_test.ts

@@ -0,0 +1,39 @@
+describe('Wave 17 Eclipse: Agent Auth Session Token Lifecycle Guard', () => {
+  interface AuthSession {
+    agentId: string;
+    token: string;
+    issuedAt: number; // UNIX seconds
+    expiresAt: number; // UNIX seconds
+  }
+
+  const isSessionValid = (session: AuthSession, currentTimestamp: number): boolean => {
+    if (!session.token || session.token.trim().length === 0) return false;
+    if (session.expiresAt <= session.issuedAt) return false;
+    if (currentTimestamp >= session.expiresAt) return false;
+    if (currentTimestamp < session.issuedAt) return false; // Clock skew anomaly
+    return true;
+  };
+
+  it('should validate active sessions within validity window', () => {
+    const session: AuthSession = {
+      agentId: 'agent_007',
+      token: 'tok_live_abc123',
+      issuedAt: 1000,
+      expiresAt: 2000
+    };
+    expect(isSessionValid(session, 1500)).toBe(true);
+    expect(isSessionValid(session, 1000)).toBe(true);
+  });
+
+  it('should invalidate expired, future-skewed, or malformed session tokens', () => {
+    const session: AuthSession = {
+      agentId: 'agent_007',
+      token: 'tok_live_abc123',
+      issuedAt: 1000,
+      expiresAt: 2000
+    };
+    expect(isSessionValid(session, 2000)).toBe(false); // Expired on exact boundary
+    expect(isSessionValid(session, 2500)).toBe(false); // Expired past boundary
+    expect(isSessionValid(session, 900)).toBe(false);  // Future clock skew
+  });
+});