Wrapped up MockK unit tests for auth-service-lib - JwtClaimsService, JwtAuthenticationProvider, and JwtAuthenticationFilter are now fully covered. Burned a good chunk of time on one annoying issue with relaxed = true on the HttpServletRequest mock - OncePerRequestFilter internally checks getAttribute/getDispatcherType before even reaching the actual filter logic, and the relaxed mock was returning non-null instead of null, so tests were passing for entirely the wrong reason. Lesson learned: when mocking Servlet API, better to explicitly stub those two calls in @BeforeEach instead of relying on relaxed.
Code review also turned up a real security gap in validate() - a token with no exp claim was passing validation as effectively non-expiring, since JJWT only throws ExpiredJwtException when exp is present and past, not when it’s missing entirely. Fix incoming.
Holding off on MVC/@WebMvcTest for the controllers for now - fixing a handful of code review items first (the missing exp check, plus making exception handling consistent in extractExpiration), then back to controller tests and GlobalExceptionHandler.