fix(redis): expire stale blocks on read in getActiveBlock()

Root cause:
getActiveBlock() returned expired blocks because no TTL validation
or cleanup was performed during read operations.

Fix:
- Validate expires_at against current time
- Delete expired Redis block key on access
- Return null to honor getActiveBlock() contract

This aligns RedisSecurityGuard behavior with IntegrationV2
expectations and prevents stale security blocks from leaking
into higher-level logic.

No refactors or behavior changes beyond the minimal fix.

Author: megyptm

tests/IntegrationV2/Redis/RedisIntegrationFlowTest.php

@@ -48,7 +48,8 @@ protected function createAdapter(): AdapterInterface
         // STRICT: Use DatabaseResolver to fetch the configured Redis adapter.
         // This mimics production behavior where connection details (DSN, Auth, etc.) are hidden.
 
-        $config = new EnvironmentConfig(__DIR__ . '/../../'); // Uses EnvironmentLoader-loaded DSN
+        // Use explicit base path to ensure deterministic DSN resolution across environments
+        $config = new EnvironmentConfig(__DIR__ . '/../../');
         $resolver = new DatabaseResolver($config);
 
         // Resolve 'redis.cache' profile with auto-connect enabled

tests/IntegrationV2/Redis/RedisTTLExpiryTest.php

@@ -0,0 +1,121 @@
+<?php
+
+/**
+ * @copyright   ©2025 Maatify.dev
+ * @Library     maatify/security-guard
+ * @Project     maatify:security-guard
+ * @author      Mohamed Abdulalim (megyptm) <mohamed@maatify.dev>
+ * @since       2025-02-24 10:00
+ * @see         https://www.maatify.dev Maatify.dev
+ * @link        https://github.com/Maatify/security-guard view project on GitHub
+ * @note        Distributed in the hope that it will be useful - WITHOUT WARRANTY.
+ */
+
+declare(strict_types=1);
+
+namespace Maatify\SecurityGuard\Tests\IntegrationV2\Redis;
+
+use Maatify\Common\Contracts\Adapter\AdapterInterface;
+use Maatify\DataAdapters\Core\DatabaseResolver;
+use Maatify\DataAdapters\Core\EnvironmentConfig;
+use Maatify\SecurityGuard\Drivers\RedisSecurityGuard;
+use Maatify\SecurityGuard\DTO\SecurityBlockDTO;
+use Maatify\SecurityGuard\Enums\BlockTypeEnum;
+use Maatify\SecurityGuard\Tests\IntegrationV2\BaseIntegrationV2TestCase;
+
+/**
+ * RedisTTLExpiryTest
+ *
+ * Verifies real Redis TTL expiry behavior using IntegrationV2 architecture.
+ */
+class RedisTTLExpiryTest extends BaseIntegrationV2TestCase
+{
+    private ?RedisSecurityGuard $guard = null;
+
+    protected function validateEnvironment(): void
+    {
+        // STRICT: Environment validation is delegated to DatabaseResolver / EnvironmentLoader.
+    }
+
+    protected function createAdapter(): AdapterInterface
+    {
+        // STRICT: Use DatabaseResolver to fetch the configured Redis adapter.
+        $config = new EnvironmentConfig(__DIR__ . '/../../');
+        $resolver = new DatabaseResolver($config);
+
+        // Resolve 'redis.cache' profile with auto-connect enabled
+        return $resolver->resolve('redis.cache', true);
+    }
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // STRICT: Fail if not connected. No skipping allowed.
+        if (!$this->adapter->isConnected()) {
+            $this->fail('Redis adapter (redis.cache) failed to connect. Ensure DSN configuration is valid and Redis is running.');
+        }
+
+        $this->guard = new RedisSecurityGuard($this->adapter, $this->identifierStrategy);
+    }
+
+    public function testRedisTTLExpiry(): void
+    {
+        // Assert guard is initialized to satisfy PHPStan nullable check
+        $this->assertNotNull($this->guard, 'Guard should have been initialized in setUp');
+        $guard = $this->guard;
+
+        // 1. Setup Identity
+        $ip = '192.168.1.101';
+        $subject = 'ttl_user_' . bin2hex(random_bytes(4));
+
+        // Ensure clean state
+        $guard->resetAttempts($ip, $subject);
+        $guard->unblock($ip, $subject);
+
+        // 2. Apply Block with Short TTL (5 seconds)
+        $ttlSeconds = 5;
+        $expiryTime = time() + $ttlSeconds;
+
+        $block = new SecurityBlockDTO(
+            ip: $ip,
+            subject: $subject,
+            type: BlockTypeEnum::AUTO,
+            expiresAt: $expiryTime,
+            createdAt: time()
+        );
+
+        $guard->block($block);
+
+        // 3. Immediately Assert Blocked
+        $this->assertTrue($guard->isBlocked($ip, $subject), 'Subject should be immediately blocked.');
+
+        // Verify TTL is roughly correct (allow some variance)
+        $remaining = $guard->getRemainingBlockSeconds($ip, $subject);
+        $this->assertNotNull($remaining);
+        $this->assertGreaterThan(0, $remaining);
+        $this->assertLessThanOrEqual($ttlSeconds, $remaining);
+
+        // 4. Wait for Expiry (Deterministic Polling)
+        $maxWaitSeconds = $ttlSeconds + 2;
+        $waited = 0;
+        $intervalUs = 200000; // 200ms
+        $expired = false;
+
+        $startTime = microtime(true);
+        while ((microtime(true) - $startTime) < $maxWaitSeconds) {
+            // @phpstan-ignore-next-line
+            if (!$guard->isBlocked($ip, $subject)) {
+                $expired = true;
+                break;
+            }
+            usleep($intervalUs);
+        }
+
+        // 5. Assert Expired
+        // @phpstan-ignore-next-line
+        $this->assertTrue($expired, 'Block did not expire within expected window.');
+        $this->assertFalse($guard->isBlocked($ip, $subject), 'Subject should be unblocked after TTL expiry.');
+        $this->assertNull($guard->getActiveBlock($ip, $subject), 'Active block should be null after expiry.');
+    }
+}