// Use the minimum of 1 hour or half the lifetime as the thresholdrefreshThreshold:=min(time.Hour,apiKeyLifetime/2)

refreshThreshold:=apiKeyLifetime-time.HourifapiKeyLifetime<time.Hour {refreshThreshold=apiKeyLifetime/2}

// Use the minimum of 1 hour or half the lifetime as the threshold// This ensures reasonable refresh intervals for all key lifetimesrefreshThreshold:=min(time.Hour,apiKeyLifetime/2)

funcTestAPIKeyExpiryRefresh(t*testing.T) {t.Parallel()testCases:= []struct {namestringlifetime       time.DurationtimeRemaining  time.DurationshouldRefreshbool    }{        {"30min key, 10min remaining",30*time.Minute,10*time.Minute,true},        {"30min key, 20min remaining",30*time.Minute,20*time.Minute,false},        {"1hour key, 25min remaining",time.Hour,25*time.Minute,true},        {"1hour key, 35min remaining",time.Hour,35*time.Minute,false},        {"2hour key, 30min remaining",2*time.Hour,30*time.Minute,true},        {"2hour key, 90min remaining",2*time.Hour,90*time.Minute,false},        {"8hour key, 30min remaining",8*time.Hour,30*time.Minute,true},        {"8hour key, 90min remaining",8*time.Hour,90*time.Minute,false},    }for_,tc:=rangetestCases {t.Run(tc.name,func(t*testing.T) {// Use client.CreateToken with desired lifetime// Make actual API call to test refresh behavior        })    }}

// For short-lived keys (< 1 hour), refresh when half the lifetime remains.// For longer keys, refresh when 1 hour remains.refreshThreshold:=apiKeyLifetime-time.HourifapiKeyLifetime<time.Hour {refreshThreshold=apiKeyLifetime/2}

// Use the minimum of 1 hour or half the lifetime as the threshold.// This ensures reasonable refresh intervals for all key lifetimes.refreshThreshold:=min(time.Hour,apiKeyLifetime/2)

funcTestAPIKeyExpiryRefresh(t*testing.T) {t.Parallel()testCases:= []struct {namestringlifetime       time.DurationtimeRemaining  time.DurationshouldRefreshbooldescriptionstring    }{        {name:"ShortKey_ShouldRefresh",lifetime:30*time.Minute,timeRemaining:10*time.Minute,shouldRefresh:true,description:"30min key with 10min remaining should refresh (< 15min threshold)",        },        {name:"ShortKey_ShouldNotRefresh",lifetime:30*time.Minute,timeRemaining:20*time.Minute,shouldRefresh:false,description:"30min key with 20min remaining should not refresh (> 15min threshold)",        },        {name:"OneHourKey_ShouldRefresh",lifetime:time.Hour,timeRemaining:25*time.Minute,shouldRefresh:true,description:"1hour key with 25min remaining should refresh (< 30min threshold)",        },        {name:"OneHourKey_ShouldNotRefresh",lifetime:time.Hour,timeRemaining:35*time.Minute,shouldRefresh:false,description:"1hour key with 35min remaining should not refresh (> 30min threshold)",        },        {name:"TwoHourKey_ShouldRefresh",lifetime:2*time.Hour,timeRemaining:30*time.Minute,shouldRefresh:true,description:"2hour key with 30min remaining should refresh (< 1hour threshold)",        },        {name:"TwoHourKey_ShouldNotRefresh",lifetime:2*time.Hour,timeRemaining:90*time.Minute,shouldRefresh:false,description:"2hour key with 90min remaining should not refresh (> 1hour threshold)",        },        {name:"LongKey_ShouldRefresh",lifetime:8*time.Hour,timeRemaining:30*time.Minute,shouldRefresh:true,description:"8hour key with 30min remaining should refresh (< 1hour threshold)",        },        {name:"LongKey_ShouldNotRefresh",lifetime:8*time.Hour,timeRemaining:90*time.Minute,shouldRefresh:false,description:"8hour key with 90min remaining should not refresh (> 1hour threshold)",        },    }for_,tc:=rangetestCases {t.Run(tc.name,func(t*testing.T) {t.Parallel()var (db,_=dbtestutil.NewDB(t)user=dbgen.User(t,db, database.User{})now=time.Now()expiresAt=now.Add(tc.timeRemaining)sentAPIKey,token=dbgen.APIKey(t,db, database.APIKey{UserID:user.ID,LastUsed:dbtime.Now().Add(-time.Hour),ExpiresAt:dbtime.Time(expiresAt),LifetimeSeconds:int64(tc.lifetime.Seconds()),                })r=httptest.NewRequest("GET","/",nil)rw=httptest.NewRecorder()            )r.Header.Set(codersdk.SessionTokenHeader,token)successHandler:=http.HandlerFunc(func(rw http.ResponseWriter,r*http.Request) {httpapi.Write(r.Context(),rw,http.StatusOK, codersdk.Response{Message:"It worked!",                })            })httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{DB:db,RedirectToLogin:false,            })(successHandler).ServeHTTP(rw,r)res:=rw.Result()deferres.Body.Close()require.Equal(t,http.StatusOK,res.StatusCode)// Verify refresh behaviorgotAPIKey,err:=db.GetAPIKeyByID(r.Context(),sentAPIKey.ID)require.NoError(t,err)iftc.shouldRefresh {require.True(t,gotAPIKey.ExpiresAt.After(sentAPIKey.ExpiresAt),"API key should have been refreshed: %s",tc.description)expectedExpiry:=now.Add(tc.lifetime)require.WithinDuration(t,expectedExpiry,gotAPIKey.ExpiresAt,time.Second,"API key should be extended by full lifetime")            }else {require.Equal(t,sentAPIKey.ExpiresAt,gotAPIKey.ExpiresAt,"API key should NOT have been refreshed: %s",tc.description)            }        })    }// Test with refresh disabledt.Run("RefreshDisabled",func(t*testing.T) {t.Parallel()var (db,_=dbtestutil.NewDB(t)user=dbgen.User(t,db, database.User{})now=time.Now()lifetime=int64(120)sentAPIKey,token=dbgen.APIKey(t,db, database.APIKey{UserID:user.ID,LastUsed:dbtime.Now().Add(-time.Hour),ExpiresAt:dbtime.Time(now.Add(30*time.Second)),LifetimeSeconds:lifetime,            })r=httptest.NewRequest("GET","/",nil)rw=httptest.NewRecorder()        )r.Header.Set(codersdk.SessionTokenHeader,token)successHandler:=http.HandlerFunc(func(rw http.ResponseWriter,r*http.Request) {httpapi.Write(r.Context(),rw,http.StatusOK, codersdk.Response{Message:"It worked!",            })        })httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{DB:db,RedirectToLogin:false,DisableSessionExpiryRefresh:true,        })(successHandler).ServeHTTP(rw,r)res:=rw.Result()deferres.Body.Close()require.Equal(t,http.StatusOK,res.StatusCode)gotAPIKey,err:=db.GetAPIKeyByID(r.Context(),sentAPIKey.ID)require.NoError(t,err)require.Equal(t,sentAPIKey.ExpiresAt,gotAPIKey.ExpiresAt,"API key should NOT have been refreshed when refresh is disabled")    })}