From 0d4631c5a8b34ccfc6752973eee07049cb27beaa Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sat, 24 Oct 2026 17:56:38 +0200
Subject: [PATCH] test: bound the impersonation expiry by both ends of the
 handoff

---
 lib/__tests__/impersonation-session.test.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/lib/__tests__/impersonation-session.test.ts b/lib/__tests__/impersonation-session.test.ts
index 8202b5aff..8650c967e 100644
--- a/lib/__tests__/impersonation-session.test.ts
+++ b/lib/__tests__/impersonation-session.test.ts
@@ -128,9 +128,12 @@ describe('impersonation handoff', () => {
     expect(method).toBe('x:AppPassword/set');
     expect(args.accountId).toBe('acc-alice');
     expect(args.create.imp.expiresAt).toMatch(/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\dZ$/);
-    const ttl = Date.parse(args.create.imp.expiresAt) - before;
-    expect(ttl).toBeGreaterThan(7 * 3600_000);
-    expect(ttl).toBeLessThanOrEqual(8 * 3600_000);
+    // The handoff reads the clock after `before` was taken, so bound the
+    // expiry by both ends instead of measuring from `before` alone.
+    const after = Date.now();
+    const expires = Date.parse(args.create.imp.expiresAt);
+    expect(expires - before).toBeGreaterThan(7 * 3600_000);
+    expect(expires).toBeLessThanOrEqual(after + 8 * 3600_000);
   });
 
   it('refuses the handoff when Stalwart does not create the app password', async () => {