Address review: gofmt the minter cert literal + test the wall-clock deadline

- gofmt: re-align the x509.Certificate{} literal. The prior edit de-aligned
  NotBefore:/NotAfter: to one space; gofmt -l flagged minter.go (CI missed it
  because go-fmt pre-commit only covers proxy-init/).
- test: add TestMinter_CacheDeadlineIsWallClock, asserting the cache freshness
  deadline carries no monotonic reading (exp == exp.Round(0)) — directly
  guarding the .Round(0) suspend fix, which the existing test did not exercise.
  Clarify that TestMinter_ReMintsWallClockExpiredLeaf covers the NotAfter
  backstop (a state normal operation cannot produce).

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/tlsbridge/minter.go

@@ -118,10 +118,10 @@ func (m *Minter) mint(host string) (*tls.Certificate, error) {
 	tmpl := &x509.Certificate{
 		SerialNumber: serial,
 		Subject:      pkix.Name{CommonName: host},
-		NotBefore: time.Now().Add(-time.Minute),
+		NotBefore:    time.Now().Add(-time.Minute),
 		// Leaf validity outlasts the cache deadline (now+ttl) by renewBefore so
 		// a cached leaf is always re-minted before it can serve past expiry.
-		NotAfter: time.Now().Add(m.ttl + renewBefore),
+		NotAfter:    time.Now().Add(m.ttl + renewBefore),
 		KeyUsage:    x509.KeyUsageDigitalSignature,
 		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
 	}

authbridge/authlib/tlsbridge/minter_test.go

@@ -124,11 +124,11 @@ func TestMinter_LRUEvictsOldest(t *testing.T) {
 	}
 }
 
-// TestMinter_ReMintsWallClockExpiredLeaf is the regression guard for the
-// suspend/VM-pause bug: the cached leaf is expired by the wall clock, but the
-// process monotonic clock froze during suspend so the cache deadline still
-// reads as fresh. The minter must gate on the leaf's real NotAfter and
-// re-mint, never serve a leaf the client will reject as expired.
+// TestMinter_ReMintsWallClockExpiredLeaf exercises the NotAfter backstop: if a
+// cached leaf is ever wall-clock-expired while the cache deadline still reads
+// fresh, Get must gate on the leaf's real NotAfter and re-mint rather than
+// serve a cert the client rejects. (The primary suspend fix — the wall-clock
+// cache deadline — is guarded by TestMinter_CacheDeadlineIsWallClock.)
 func TestMinter_ReMintsWallClockExpiredLeaf(t *testing.T) {
 	m, _ := newTestMinter(t) // LeafTTL=time.Hour, so the cache deadline stays "fresh"
 	c1, err := m.GetCertificateForHost("h.example.com")
@@ -158,3 +158,23 @@ func TestMinter_ReMintsWallClockExpiredLeaf(t *testing.T) {
 		t.Fatal("re-minted leaf is not valid")
 	}
 }
+
+// TestMinter_CacheDeadlineIsWallClock guards the actual suspend fix: the cache
+// freshness deadline must carry NO monotonic clock reading, so the freshness
+// check falls back to the wall clock and expires correctly across a host
+// suspend (where the monotonic clock freezes but wall time advances). A
+// monotonic-carrying deadline is exactly what made the cache keep serving a
+// wall-clock-expired leaf. time.Time's == compares the monotonic reading too,
+// so a deadline that still carried one would not equal its .Round(0) form.
+func TestMinter_CacheDeadlineIsWallClock(t *testing.T) {
+	m, _ := newTestMinter(t)
+	if _, err := m.GetCertificateForHost("h.example.com"); err != nil {
+		t.Fatalf("mint: %v", err)
+	}
+	m.mu.Lock()
+	exp := m.items["h.example.com"].Value.(*cacheEntry).expires
+	m.mu.Unlock()
+	if exp != exp.Round(0) {
+		t.Errorf("cache deadline carries a monotonic clock reading; must be wall-clock (.Round(0)) to survive suspend")
+	}
+}