update

tests/Jiaowu.Api.Tests/AttendanceCheckInChallengeTests.cs

@@ -0,0 +1,42 @@
+using Jiaowu.Api.Infrastructure.Teaching;
+
+namespace Jiaowu.Api.Tests;
+
+public sealed class AttendanceCheckInChallengeTests
+{
+    [Fact]
+    public void Challenge_IsBoundToSheetSecretAndTwentySecondLifetime()
+    {
+        var sheetId = Guid.NewGuid();
+        var issuedAt = new DateTime(2026, 7, 28, 8, 0, 0, DateTimeKind.Utc);
+        var challenge = AttendanceCheckInChallenge.Create(
+            sheetId,
+            "sheet-secret",
+            issuedAt);
+
+        Assert.True(AttendanceCheckInChallenge.TryReadSheetId(
+            challenge.Token,
+            out var parsedSheetId));
+        Assert.Equal(sheetId, parsedSheetId);
+        Assert.True(AttendanceCheckInChallenge.IsValid(
+            challenge.Token,
+            sheetId,
+            "sheet-secret",
+            issuedAt.AddSeconds(20)));
+        Assert.False(AttendanceCheckInChallenge.IsValid(
+            challenge.Token,
+            sheetId,
+            "sheet-secret",
+            issuedAt.AddSeconds(21)));
+        Assert.False(AttendanceCheckInChallenge.IsValid(
+            challenge.Token,
+            Guid.NewGuid(),
+            "sheet-secret",
+            issuedAt));
+        Assert.False(AttendanceCheckInChallenge.IsValid(
+            challenge.Token,
+            sheetId,
+            "different-secret",
+            issuedAt));
+    }
+}