anchor.diff:          rpc:call(Worker1, auth_manager, verify, [TokenAuth])
       ),
       ok = ssl:close(Sock).
  +
  +
  +token_expiration(Config) ->
  +    [Worker1 | _] = ?config(op_worker_nodes, Config),
  +    Nonce = <<"token_expiration">>,
  +
  +    % Session should be terminated after time caveat expiration
  +    AccessToken1 = initializer:create_access_token(?USER_ID, [#cv_time{
  +        valid_until = time_utils:system_time_seconds() + 2
  +    }]),
  +    TokenAuth1 = auth_manager:build_token_auth(
  +        AccessToken1, undefined,
  +        initializer:local_ip_v4(), oneclient, allow_data_access_caveats
  +    ),
  +
  +    {ok, {_, SessId1}} = fuse_test_utils:connect_via_token(Worker1, [], Nonce, AccessToken1),
  +
  +    ?assertMatch(
  +        {ok, #document{value = #session{identity = ?SUB(user, ?USER_ID)}}},
  +        rpc:call(Worker1, session, get, [SessId1])
  +    ),
  +    ?assertMatch(
  +        {ok, ?USER(?USER_ID), _},
  +        rpc:call(Worker1, auth_manager, verify, [TokenAuth1])
  +    ),
  +
  +    timer:sleep(timer:seconds(4)),
  +
  +    ?assertMatch(
  +        {error, not_found},
  +        rpc:call(Worker1, session, get, [SessId1])
  +    ),
  +    ?assertMatch(
  +        ?ERROR_UNAUTHORIZED,
  +        rpc:call(Worker1, auth_manager, verify, [TokenAuth1])
  +    ),
  +
  +    % But it is possible to update credentials and increase expiration
  +    AccessToken2 = initializer:create_access_token(?USER_ID, [#cv_time{
  +        valid_until = time_utils:system_time_seconds() + 4
  +    }]),
  +    {ok, {_, SessId2}} = fuse_test_utils:connect_via_token(
  +        Worker1, [], Nonce, AccessToken2
  +    ),
  +    ?assertMatch(
  +        {ok, #document{value = #session{identity = ?SUB(user, ?USER_ID)}}},
  +        rpc:call(Worker1, session, get, [SessId2])
  +    ),
  +
  +    timer:sleep(timer:seconds(2)),
  +    ?assertMatch(
  +        {ok, #document{value = #session{identity = ?SUB(user, ?USER_ID)}}},
  +        rpc:call(Worker1, session, get, [SessId2])
  +    ),
  +
  +    AccessToken3 = initializer:create_access_token(?USER_ID, [#cv_time{
  +        valid_until = time_utils:system_time_seconds() + 6
  +    }]),
  +    rpc:call(Worker1, incoming_session_watcher, schedule_credentials_update, [
  +        SessId2, AccessToken3, undefined
  +    ]),
  +
  +    timer:sleep(timer:seconds(4)),
  +    ?assertMatch(
  +        {ok, #document{value = #session{identity = ?SUB(user, ?USER_ID)}}},
  +        rpc:call(Worker1, session, get, [SessId2])
  +    ),
  +
  +    timer:sleep(timer:seconds(4)),
  +    ?assertMatch(
  +        {error, not_found},
  +        rpc:call(Worker1, session, get, [SessId2])
  +    ).
   
   
   %%%===================================================================
  
positive.code: token_authentication(Config) ->
      % given
      [Worker1 | _] = ?config(op_worker_nodes, Config),
      Nonce = <<"nonce">>,
      AccessToken = initializer:create_access_token(?USER_ID),
      TokenAuth = auth_manager:build_token_auth(
          AccessToken, undefined,
  
negative.code: 
  -export([
      auth_cache_test/1,
      token_authentication/1,
      token_expiration/1
  ]).
  
  all() -> ?ALL([
      auth_cache_test,
      token_authentication,
      token_expiration
  ]).
  
  
  