test(unit): add roles, web deps, use cases, VO boundary tests — reach 70% coverage

tests/unit/infrastructure/test_auth.py

@@ -234,6 +234,28 @@ class TestKeycloakAuthClient:
         assert mock_async_client.post.call_count == 1
         assert result1.user_id == result2.user_id
 
+    def test_get_cached_token_expired(self, client: KeycloakAuthClient) -> None:
+        """Test expired cache entry returns None and is removed."""
+        from app.infrastructure.auth.models import TokenInfo
+
+        client._cache["expired-token"] = (TokenInfo(active=True), 0)
+        with patch("time.time", return_value=1000):
+            result = client._get_cached_token("expired-token")
+        assert result is None
+        assert "expired-token" not in client._cache
+
+    def test_cache_token_removes_expired_entries(self, client: KeycloakAuthClient) -> None:
+        """Test caching new token removes expired existing entries."""
+        from app.infrastructure.auth.models import TokenInfo
+
+        old_token = TokenInfo(active=True)
+        new_token = TokenInfo(active=True)
+        client._cache["old"] = (old_token, 0)
+        with patch("time.time", return_value=1000):
+            client._cache_token("new", new_token)
+        assert "old" not in client._cache
+        assert "new" in client._cache
+
     @pytest.mark.asyncio
     async def test_get_userinfo_success(self, client: KeycloakAuthClient) -> None:
         """Test successful userinfo retrieval."""