fix(andreknie.de): close data lifecycle review gaps

privat/CV/andreknie.de/server/services/confirmationToken.test.js

@@ -1,16 +1,38 @@
-import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { existsSync, readFileSync, unlinkSync } from 'fs'
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from 'vitest'
+import { existsSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from 'fs'
+import { tmpdir } from 'os'
 import { join } from 'path'
-import { createToken, reserveToken, completeToken, releaseToken, cleanupExpiredTokens } from './confirmationToken.js'
 
-const tokensFile = join(process.cwd(), 'server', 'data', 'pending-tokens.json')
+let testDir
+let tokensFile
+let createToken
+let reserveToken
+let completeToken
+let releaseToken
+let cleanupExpiredTokens
 
 function removeTokensFile() {
   if (existsSync(tokensFile)) unlinkSync(tokensFile)
 }
 
+beforeAll(async () => {
+  testDir = mkdtempSync(join(tmpdir(), 'andreknie-token-test-'))
+  tokensFile = join(testDir, 'pending-tokens.json')
+  process.env.CONFIRMATION_TOKEN_FILE = tokensFile
+
+  const service = await import('./confirmationToken.js')
+  createToken = service.createToken
+  reserveToken = service.reserveToken
+  completeToken = service.completeToken
+  releaseToken = service.releaseToken
+  cleanupExpiredTokens = service.cleanupExpiredTokens
+})
 beforeEach(removeTokensFile)
 afterEach(removeTokensFile)
+afterAll(() => {
+  delete process.env.CONFIRMATION_TOKEN_FILE
+  rmSync(testDir, { recursive: true, force: true })
+})
 
 describe('confirmation token lifecycle', () => {
   it('creates a pending token and reserves it once', async () => {
@@ -55,8 +77,13 @@ describe('confirmation token lifecycle', () => {
 
   it('cleans expired pending and processing entries', async () => {
     const pending = await createToken('contact', { email: 'pending@example.invalid' }, -1)
-    const processing = await createToken('contact', { email: 'processing@example.invalid' }, -1)
+    const processing = await createToken('contact', { email: 'processing@example.invalid' }, 1)
     await reserveToken(processing)
+
+    const stored = JSON.parse(readFileSync(tokensFile, 'utf8'))
+    stored.find(entry => entry.token === processing).expiresAt = new Date(Date.now() - 1000).toISOString()
+    writeFileSync(tokensFile, JSON.stringify(stored), 'utf8')
+
     await cleanupExpiredTokens()
 
     expect(pending).toBeTruthy()