fix(auth): enforce Keycloak access token age

tests/auth/test_keycloak_dependencies.py

@@ -1,7 +1,11 @@
 import pytest
 from fastapi import HTTPException
 
-from app.auth.keycloak_dependencies import get_current_keycloak_username
+from app.auth import keycloak_dependencies
+from app.auth.keycloak_dependencies import (
+    _decode_keycloak_token,
+    get_current_keycloak_username,
+)
 
 
 @pytest.fixture
@@ -28,3 +32,42 @@ async def test_current_username_rejects_username_fallback():
 
     assert exc.value.status_code == 401
     assert exc.value.detail == "Missing preferred_username claim"
+
+
+def test_decode_keycloak_token_rejects_a_token_older_than_the_configured_limit(
+    monkeypatch: pytest.MonkeyPatch,
+):
+    monkeypatch.setattr(keycloak_dependencies.settings, "KEYCLOAK_PUBLIC_KEY", "public-key")
+    monkeypatch.setattr(
+        keycloak_dependencies.settings,
+        "KEYCLOAK_ACCESS_TOKEN_MAX_AGE_SECONDS",
+        900,
+    )
+    monkeypatch.setattr(keycloak_dependencies.time, "time", lambda: 2_000)
+    monkeypatch.setattr(
+        keycloak_dependencies.jwt,
+        "decode",
+        lambda *args, **kwargs: {"iat": 1_000},
+    )
+
+    with pytest.raises(keycloak_dependencies.JWTError):
+        _decode_keycloak_token("expired-by-policy")
+
+
+def test_decode_keycloak_token_accepts_a_recent_token(
+    monkeypatch: pytest.MonkeyPatch,
+):
+    monkeypatch.setattr(keycloak_dependencies.settings, "KEYCLOAK_PUBLIC_KEY", "public-key")
+    monkeypatch.setattr(
+        keycloak_dependencies.settings,
+        "KEYCLOAK_ACCESS_TOKEN_MAX_AGE_SECONDS",
+        900,
+    )
+    monkeypatch.setattr(keycloak_dependencies.time, "time", lambda: 1_500)
+    monkeypatch.setattr(
+        keycloak_dependencies.jwt,
+        "decode",
+        lambda *args, **kwargs: {"iat": 1_000, "sub": "subject"},
+    )
+
+    assert _decode_keycloak_token("recent") == {"iat": 1_000, "sub": "subject"}