fix leeway implementation and tests

Author: divoxx

token.go

@@ -282,8 +282,9 @@ func (t Token) Verify(issuer, subject, audience string, leeway time.Duration) er
 
 // Valid checks if the token is valid yet.
 func (t Token) Valid(leeway time.Duration) bool {
-	now := clock.Now().UTC().Add(leeway)
-	return now.After(t.NotBefore)
+	now := clock.Now().UTC()
+	nbf := t.NotBefore.Add(-leeway)
+	return nbf.Before(now)
 }
 
 // Expired checks if the token has expired.
@@ -296,8 +297,9 @@ func (t Token) Expired(leeway time.Duration) bool {
 		return false
 	}
 
-	now := clock.Now().UTC().Add(leeway)
-	return now.After(t.Expires)
+	now := clock.Now().UTC()
+	exp := t.Expires.Add(leeway)
+	return now.After(exp)
 }
 
 // buildHeader builds a new header map ready for signing.

token_test.go

@@ -433,10 +433,10 @@ func TestTokenExpired_True(t *testing.T) {
 	}
 }
 
-func TestTokenExpired_LeewayTrue(t *testing.T) {
+func TestTokenExpired_LeewayFalse(t *testing.T) {
 	tkn := NewToken()
 	tkn.Expires = tkn.IssuedAt.Add(1 * time.Hour)
-	if !tkn.Expired(1 * time.Hour) {
+	if tkn.Expired(1 * time.Hour) {
 		t.Fatal("expected true, got false")
 	}
 }