Refine MCP token expiry enforcement

Agent-Logs-Url: https://github.com/IntelliTect/EssentialCSharp.Web/sessions/29b86c94-db59-4104-8285-197ae2428813

Co-authored-by: BenjaminMichaelis <22186029+BenjaminMichaelis@users.noreply.github.com>

Author: Copilot

EssentialCSharp.Web/Services/McpApiTokenService.cs

@@ -14,11 +14,11 @@ public class McpApiTokenService(EssentialCSharpWebContext db)
 
     public sealed record ResolvedMcpApiToken(Guid TokenId, string UserId);
 
-    public static DateOnly GetDefaultExpiryDate(DateTime? utcNow = null)
-        => DateOnly.FromDateTime(utcNow ?? DateTime.UtcNow).AddMonths(DefaultLifetimeMonths);
+    public static DateOnly GetDefaultExpiryDate(DateTime? utcNowOverride = null)
+        => DateOnly.FromDateTime(utcNowOverride ?? DateTime.UtcNow).AddMonths(DefaultLifetimeMonths);
 
-    public static DateTime GetDefaultExpirationUtc(DateTime? utcNow = null)
-        => GetDefaultExpiryDate(utcNow).ToDateTime(TimeOnly.MaxValue, DateTimeKind.Utc);
+    public static DateTime GetDefaultExpirationUtc(DateTime? utcNowOverride = null)
+        => GetDefaultExpiryDate(utcNowOverride).ToDateTime(TimeOnly.MaxValue, DateTimeKind.Utc);
 
     /// <summary>Returns SHA-256 hash of the raw token as a byte array (varbinary(32)).</summary>
     public static byte[] HashToken(string rawToken)
@@ -40,10 +40,7 @@ public static string GenerateRawToken()
     {
         string raw = GenerateRawToken();
         DateTime createdAt = DateTime.UtcNow;
-        DateTime maxExpiration = GetDefaultExpirationUtc(createdAt);
-        DateTime effectiveExpiration = expiresAt ?? maxExpiration;
-        if (effectiveExpiration > maxExpiration)
-            throw new ArgumentOutOfRangeException(nameof(expiresAt), MaxExpiryValidationMessage);
+        DateTime effectiveExpiration = ResolveExpiration(expiresAt, createdAt);
 
         var entity = new McpApiToken
         {
@@ -58,6 +55,18 @@ public static string GenerateRawToken()
         return (raw, entity);
     }
 
+    private static DateTime ResolveExpiration(DateTime? requestedExpirationUtc, DateTime createdAtUtc)
+    {
+        DateTime maxExpiration = GetDefaultExpirationUtc(createdAtUtc);
+        if (requestedExpirationUtc is null)
+            return maxExpiration;
+
+        if (requestedExpirationUtc > maxExpiration)
+            throw new ArgumentOutOfRangeException(nameof(requestedExpirationUtc), MaxExpiryValidationMessage);
+
+        return requestedExpirationUtc.Value;
+    }
+
     /// <summary>
     /// Revokes a token by ID. Validates ownership to prevent cross-user revocation.
     /// Returns false if token not found or user doesn't own it.