Tighten MCP expiry tests and page model flow

Agent-Logs-Url: https://github.com/IntelliTect/EssentialCSharp.Web/sessions/29b86c94-db59-4104-8285-197ae2428813

Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>

Author: Copilot

EssentialCSharp.Web.Tests/McpApiTokenServiceTests.cs

@@ -23,6 +23,21 @@ await Assert.That(entity.ExpiresAt!.Value)
             .IsEqualTo(McpApiTokenService.GetDefaultExpirationUtc(entity.CreatedAt));
     }
 
+    [Test]
+    public async Task CreateTokenAsync_WithExpiryWithinSixMonths_UsesRequestedExpiry()
+    {
+        string userId = await McpTestHelper.CreateUserAsync(factory, "mcp-custom-expiry");
+
+        using var scope = factory.Services.CreateScope();
+        var tokenService = scope.ServiceProvider.GetRequiredService<McpApiTokenService>();
+        DateTime requestedExpiry = DateTime.UtcNow.AddMonths(3);
+
+        (_, var entity) = await tokenService.CreateTokenAsync(userId, "custom-expiry", requestedExpiry);
+
+        await Assert.That(entity.ExpiresAt).IsNotNull();
+        await Assert.That(entity.ExpiresAt!.Value).IsEqualTo(requestedExpiry);
+    }
+
     [Test]
     public async Task CreateTokenAsync_WithExpiryBeyondSixMonths_Throws()
     {

EssentialCSharp.Web/Areas/Identity/Pages/Account/Manage/McpAccess.cshtml.cs

@@ -33,7 +33,8 @@ public class McpAccessModel(
     public async Task<IActionResult> OnGetAsync()
     {
         DisableCaching();
-        InitializeExpiryDefaults();
+        InitializeExpiryBounds();
+        ApplyDefaultExpiryIfMissing();
         string? userId = userManager.GetUserId(User);
         if (userId is null) return Challenge();
         UserTokens = await tokenService.GetUserTokensAsync(userId);
@@ -43,7 +44,8 @@ public async Task<IActionResult> OnGetAsync()
     public async Task<IActionResult> OnPostCreateAsync()
     {
         DisableCaching();
-        InitializeExpiryDefaults();
+        InitializeExpiryBounds();
+        ApplyDefaultExpiryIfMissing();
         string? userId = userManager.GetUserId(User);
         if (userId is null) return Challenge();
 
@@ -95,9 +97,13 @@ private void DisableCaching()
         Response.Headers.Expires = "0";
     }
 
-    private void InitializeExpiryDefaults()
+    private void InitializeExpiryBounds()
     {
         MaxExpiresOn = McpApiTokenService.GetDefaultExpiryDate();
+    }
+
+    private void ApplyDefaultExpiryIfMissing()
+    {
         ExpiresOn ??= MaxExpiresOn;
     }
 }

EssentialCSharp.Web/Services/McpApiTokenService.cs

@@ -14,11 +14,11 @@ public class McpApiTokenService(EssentialCSharpWebContext db)
 
     public sealed record ResolvedMcpApiToken(Guid TokenId, string UserId);
 
-    public static DateOnly GetDefaultExpiryDate(DateTime? utcNowOverride = null)
-        => DateOnly.FromDateTime(utcNowOverride ?? DateTime.UtcNow).AddMonths(DefaultLifetimeMonths);
+    public static DateOnly GetDefaultExpiryDate(DateTime? referenceTimeUtc = null)
+        => DateOnly.FromDateTime(referenceTimeUtc ?? DateTime.UtcNow).AddMonths(DefaultLifetimeMonths);
 
-    public static DateTime GetDefaultExpirationUtc(DateTime? utcNowOverride = null)
-        => GetDefaultExpiryDate(utcNowOverride).ToDateTime(TimeOnly.MaxValue, DateTimeKind.Utc);
+    public static DateTime GetDefaultExpirationUtc(DateTime? referenceTimeUtc = null)
+        => GetDefaultExpiryDate(referenceTimeUtc).ToDateTime(TimeOnly.MaxValue, DateTimeKind.Utc);
 
     /// <summary>Returns SHA-256 hash of the raw token as a byte array (varbinary(32)).</summary>
     public static byte[] HashToken(string rawToken)