refactor(10.2-01): nest framework packages under modules

- Move remaining beach packages and embedded admin assets\n- Rewrite framework, example, build, and gate paths

modules/bouncer/blacklist_test.go

@@ -0,0 +1,61 @@
+package bouncer
+
+import (
+	"testing"
+	"time"
+)
+
+func TestBlacklistGraceWindow(t *testing.T) {
+	bl := NewMemoryBlacklist()
+	now := time.Now()
+	if err := bl.Add(t.Context(), "jti", now.Add(time.Hour), now.Add(time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	blocked, err := bl.IsBlacklisted(t.Context(), "jti")
+	if err != nil || blocked {
+		t.Fatalf("before validUntil: blocked=%t err=%v", blocked, err)
+	}
+	if err := bl.Add(t.Context(), "due", now.Add(time.Hour), now.Add(-time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	blocked, err = bl.IsBlacklisted(t.Context(), "due")
+	if err != nil || !blocked {
+		t.Fatalf("after validUntil: blocked=%t err=%v", blocked, err)
+	}
+	if err := bl.Add(t.Context(), "now", now.Add(time.Hour), time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	blocked, err = bl.IsBlacklisted(t.Context(), "now")
+	if err != nil || !blocked {
+		t.Fatalf("at validUntil: blocked=%t err=%v", blocked, err)
+	}
+}
+
+func TestBlacklistSweep(t *testing.T) {
+	bl := NewMemoryBlacklist()
+	now := time.Now()
+	if err := bl.Add(t.Context(), "gone", now.Add(-time.Minute), now.Add(-time.Minute)); err != nil {
+		t.Fatal(err)
+	}
+	if err := bl.Add(t.Context(), "stay", now.Add(time.Hour), now.Add(-time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	if err := bl.Sweep(t.Context(), now); err != nil {
+		t.Fatal(err)
+	}
+	gone, err := bl.IsBlacklisted(t.Context(), "gone")
+	if err != nil || gone {
+		t.Fatalf("swept row still present: %t %v", gone, err)
+	}
+	stay, err := bl.IsBlacklisted(t.Context(), "stay")
+	if err != nil || !stay {
+		t.Fatalf("live row = %t %v", stay, err)
+	}
+}
+
+func TestPostgresBlacklistRejectsUnsafeTable(t *testing.T) {
+	bl := NewPostgresBlacklist(nil, "user_jwt;drop")
+	if err := bl.Add(t.Context(), "j", time.Now(), time.Now()); err == nil {
+		t.Fatal("want identifier error")
+	}
+}