From 046b8830c76b29f04fc95f3880e6abe41eeb16e7 Mon Sep 17 00:00:00 2001
From: James Sanderson <jsanderson@tailscale.com>
Date: Fri, 5 Sep 2025 14:52:44 +0100
Subject: [PATCH] ipn/ipnlocal: add state change test for key expiry

Updates tailscale/corp#31478

Signed-off-by: James Sanderson <jsanderson@tailscale.com>
---
 ipn/ipnlocal/state_test.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/ipn/ipnlocal/state_test.go b/ipn/ipnlocal/state_test.go
index c29589acc..4097a3773 100644
--- a/ipn/ipnlocal/state_test.go
+++ b/ipn/ipnlocal/state_test.go
@@ -1349,6 +1349,21 @@ func TestEngineReconfigOnStateChange(t *testing.T) {
 				Hosts:  hostsFor(node3),
 			},
 		},
+		{
+			name: "Start/Connect/Login/Expire",
+			steps: func(t *testing.T, lb *LocalBackend, cc func() *mockControl) {
+				mustDo(t)(lb.Start(ipn.Options{}))
+				mustDo2(t)(lb.EditPrefs(connect))
+				cc().authenticated(node3)
+				cc().send(nil, "", false, &netmap.NetworkMap{
+					Expiry: time.Now().Add(-time.Minute),
+				})
+			},
+			wantState:     ipn.NeedsLogin,
+			wantCfg:       &wgcfg.Config{},
+			wantRouterCfg: &router.Config{},
+			wantDNSCfg:    &dns.Config{},
+		},
 	}
 
 	for _, tt := range tests {