fix: expire abandoned auth attempts

server/domain/auth.go

@@ -130,6 +130,26 @@ func (c *AuthCoordinator) Get(attemptID string) (AuthAttempt, error) {
 	return attempt, nil
 }
 
+// Expire closes abandoned pending attempts. The caller should run this from
+// the auth maintenance loop; accepted and already terminal attempts are left
+// unchanged so audit/reconciliation can still inspect their outcome.
+func (c *AuthCoordinator) Expire(now time.Time) []AuthAttempt {
+	if c == nil || now.IsZero() {
+		return nil
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	var expired []AuthAttempt
+	for id, attempt := range c.attempts {
+		if attempt.State == AuthPending && !now.Before(attempt.ExpiresAt) {
+			attempt.State = AuthRejected
+			c.attempts[id] = attempt
+			expired = append(expired, attempt)
+		}
+	}
+	return expired
+}
+
 var (
 	ErrTicketRejected  = fmt.Errorf("steam ticket rejected")
 	ErrSessionRejected = fmt.Errorf("session rejected")

server/domain/auth_test.go

@@ -109,3 +109,21 @@ func TestAuthCoordinatorRejectsExpiredCompletion(t *testing.T) {
 		t.Fatalf("expired attempt completed: %v", err)
 	}
 }
+
+func TestAuthCoordinatorExpiresAbandonedPendingAttemptsAtBoundary(t *testing.T) {
+	now := time.Unix(1000, 0)
+	coordinator := NewAuthCoordinator()
+	ticket := SteamTicket{TicketID: "ticket-1", ExpiresAt: now.Add(time.Second)}
+	if err := coordinator.Begin("attempt-1", ticket, now); err != nil {
+		t.Fatal(err)
+	}
+	if expired := coordinator.Expire(now.Add(time.Second)); len(expired) != 1 || expired[0].State != AuthRejected {
+		t.Fatalf("expired attempts = %+v", expired)
+	}
+	if _, err := coordinator.Get("attempt-1"); !errors.Is(err, ErrAuthAttemptPending) {
+		t.Fatalf("expired attempt was exposed: %v", err)
+	}
+	if expired := coordinator.Expire(now.Add(2 * time.Second)); len(expired) != 0 {
+		t.Fatalf("expired attempt repeated: %+v", expired)
+	}
+}