From 68505d3fd371b1930271781f8e913c9f2d66c66a Mon Sep 17 00:00:00 2001
From: Chris Lu <chris.lu@gmail.com>
Date: Fri, 2 Jan 2026 20:32:32 -0800
Subject: [PATCH] feat(sts): Add IsExpired helpers and use them in expiration
 tests

- Add Credentials.IsExpired() and SessionInfo.IsExpired() in new file session_helpers.go.
- Update TestSTSSessionClaimsToSessionInfoCredentialExpiration to use helpers for clearer intent.
---
 weed/iam/sts/session_claims_test.go |  8 +++++---
 weed/iam/sts/session_helpers.go     | 20 ++++++++++++++++++++
 2 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 weed/iam/sts/session_helpers.go

diff --git a/weed/iam/sts/session_claims_test.go b/weed/iam/sts/session_claims_test.go
index fffe54a64e..6ea5e3da58 100644
--- a/weed/iam/sts/session_claims_test.go
+++ b/weed/iam/sts/session_claims_test.go
@@ -179,11 +179,13 @@ func TestSTSSessionClaimsToSessionInfoCredentialExpiration(t *testing.T) {
 			assert.True(t, sessionInfo.Credentials.Expiration.Sub(tc.expiresAt) < time.Second)
 
 			// We set tc.expiresAt to past/future values to exercise expiration handling.
-			// Assert the credentials' expiration relative to now to exercise code behavior
+			// Use helper methods to assert expiration behavior on both SessionInfo and Credentials.
 			if tc.expectNotExpired {
-				assert.True(t, time.Now().Before(sessionInfo.Credentials.Expiration), tc.description)
+				assert.False(t, sessionInfo.IsExpired(), tc.description)
+				assert.False(t, sessionInfo.Credentials.IsExpired(), tc.description)
 			} else {
-				assert.True(t, time.Now().After(sessionInfo.Credentials.Expiration), tc.description)
+				assert.True(t, sessionInfo.IsExpired(), tc.description)
+				assert.True(t, sessionInfo.Credentials.IsExpired(), tc.description)
 			}
 		})
 	}
diff --git a/weed/iam/sts/session_helpers.go b/weed/iam/sts/session_helpers.go
new file mode 100644
index 0000000000..e13d1297d9
--- /dev/null
+++ b/weed/iam/sts/session_helpers.go
@@ -0,0 +1,20 @@
+package sts
+
+import "time"
+
+// IsExpired returns true if the credentials have expired
+func (c *Credentials) IsExpired() bool {
+	if c == nil {
+		return true
+	}
+	return time.Now().After(c.Expiration)
+}
+
+// IsExpired returns true if the session has expired
+func (s *SessionInfo) IsExpired() bool {
+	// If SessionInfo is nil, consider it expired
+	if s == nil {
+		return true
+	}
+	return time.Now().After(s.ExpiresAt)
+}