From 79feaf3af35e3942d17cc9410f822c824d74dd57 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Borna=20=C5=A0unji=C4=87?= <borna.sunjic.st@gmail.com>
Date: Mon, 20 Apr 2026 13:56:28 +0200
Subject: [PATCH] test: implement tests for rotation token configuration

---
 tests/grafana/configurable-grafana.test.ts | 49 ++++++++++++++++++++++
 tests/grafana/infrastructure/index.ts      |  8 ++++
 2 files changed, 57 insertions(+)

diff --git a/tests/grafana/configurable-grafana.test.ts b/tests/grafana/configurable-grafana.test.ts
index 00179bf2..962a9c12 100644
--- a/tests/grafana/configurable-grafana.test.ts
+++ b/tests/grafana/configurable-grafana.test.ts
@@ -76,6 +76,55 @@ export function testConfigurableGrafana(ctx: GrafanaTestContext) {
     });
   });
 
+  it('should have applied the configured service account token rotation', async () => {
+    const token = ctx.outputs!.configurableGrafana.serviceAccountToken;
+
+    const hasExpired = token.hasExpired as unknown as Unwrap<
+      typeof token.hasExpired
+    >;
+    const secondsToLive = token.secondsToLive as unknown as Unwrap<
+      typeof token.secondsToLive
+    >;
+    const earlyRotationWindowSeconds =
+      token.earlyRotationWindowSeconds as unknown as Unwrap<
+        typeof token.earlyRotationWindowSeconds
+      >;
+
+    assert.strictEqual(hasExpired, false, 'Expected token to not be expired');
+    assert.strictEqual(
+      secondsToLive,
+      3_888_000,
+      'Expected configured secondsToLive (45 days) to be applied',
+    );
+    assert.strictEqual(
+      earlyRotationWindowSeconds,
+      259_200,
+      'Expected configured earlyRotationWindowSeconds (3 days) to be applied',
+    );
+  });
+
+  it('should have applied the configured access policy token rotation', async () => {
+    const token = ctx.outputs!.configurableGrafana.accessPolicyToken;
+
+    const expireAfter = token.expireAfter as unknown as Unwrap<
+      typeof token.expireAfter
+    >;
+    const earlyRotationWindow = token.earlyRotationWindow as unknown as Unwrap<
+      typeof token.earlyRotationWindow
+    >;
+
+    assert.strictEqual(
+      expireAfter,
+      '1080h',
+      'Expected configured expireAfter (45 days) to be applied',
+    );
+    assert.strictEqual(
+      earlyRotationWindow,
+      '72h',
+      'Expected configured earlyRotationWindow (3 days) to be applied',
+    );
+  });
+
   it('should have created the custom dashboard', async () => {
     const grafana = ctx.outputs!.configurableGrafana;
 
diff --git a/tests/grafana/infrastructure/index.ts b/tests/grafana/infrastructure/index.ts
index 25be3961..bef6c144 100644
--- a/tests/grafana/infrastructure/index.ts
+++ b/tests/grafana/infrastructure/index.ts
@@ -129,6 +129,14 @@ const configurableGrafana = new studion.grafana.GrafanaBuilder(
       })
       .build(),
   )
+  .withServiceAccountTokenRotation({
+    secondsToLive: 3_888_000,
+    earlyRotationWindowSeconds: 259_200,
+  })
+  .withAccessPolicyTokenRotation({
+    expireAfter: '1080h',
+    earlyRotationWindow: '72h',
+  })
   .build({ parent });
 
 export { webServer, ampWorkspace, ampGrafana, configurableGrafana };