Update PR5 converter for CacheFallbackTTL string type

CIMDRunConfig.CacheFallbackTTL changed from time.Duration to string in
PR3. The operator converter now passes the string through unchanged;
parsing to time.Duration happens in resolveCIMDConfig in the runner,
after CIMDRunConfig.Validate() has already confirmed the format.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: amirejaz

cmd/thv-operator/pkg/controllerutil/authserver.go

@@ -7,7 +7,6 @@ import (
 	"context"
 	"fmt"
 	"strings"
-	"time"
 
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -583,20 +582,14 @@ func BuildAuthServerRunConfig(
 	}
 	config.Storage = storageCfg
 
-	// Build CIMD configuration
+	// Build CIMD configuration. CacheFallbackTTL is passed as-is (string);
+	// resolveCIMDConfig in the runner parses it to time.Duration at startup.
 	if authConfig.CIMD != nil && authConfig.CIMD.Enabled {
-		cimdCfg := &authserver.CIMDRunConfig{
-			Enabled:      authConfig.CIMD.Enabled,
-			CacheMaxSize: authConfig.CIMD.CacheMaxSize,
+		config.CIMD = &authserver.CIMDRunConfig{
+			Enabled:          authConfig.CIMD.Enabled,
+			CacheMaxSize:     authConfig.CIMD.CacheMaxSize,
+			CacheFallbackTTL: authConfig.CIMD.CacheFallbackTTL,
 		}
-		if authConfig.CIMD.CacheFallbackTTL != "" {
-			ttl, err := time.ParseDuration(authConfig.CIMD.CacheFallbackTTL)
-			if err != nil {
-				return nil, fmt.Errorf("cimd.cacheFallbackTtl: %w", err)
-			}
-			cimdCfg.CacheFallbackTTL = ttl
-		}
-		config.CIMD = cimdCfg
 	}
 
 	return config, nil

cmd/thv-operator/pkg/controllerutil/authserver_test.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -2709,7 +2708,7 @@ func TestBuildAuthServerRunConfig_CIMD(t *testing.T) {
 				t.Helper()
 				assert.True(t, got.Enabled)
 				assert.Equal(t, 512, got.CacheMaxSize)
-				assert.Equal(t, 10*time.Minute, got.CacheFallbackTTL)
+				assert.Equal(t, "10m", got.CacheFallbackTTL)
 			},
 		},
 		{
@@ -2726,13 +2725,18 @@ func TestBuildAuthServerRunConfig_CIMD(t *testing.T) {
 			},
 		},
 		{
-			name: "invalid CacheFallbackTTL returns parse error",
+			name: "invalid CacheFallbackTTL passes through to runner for validation",
 			cimd: &mcpv1beta1.EmbeddedAuthServerCIMDConfig{
 				Enabled:          true,
 				CacheFallbackTTL: "not-a-duration",
 			},
-			wantErr:     true,
-			errContains: "cimd.cacheFallbackTtl",
+			wantCIMD: true,
+			checkFunc: func(t *testing.T, got *authserver.CIMDRunConfig) {
+				t.Helper()
+				// The converter passes the string through; parse errors are caught
+				// by CIMDRunConfig.Validate() or resolveCIMDConfig in the runner.
+				assert.Equal(t, "not-a-duration", got.CacheFallbackTTL)
+			},
 		},
 	}