you will have to pass in *some* product object to test JWT generation but it doesn't matter which one you pass in. You could test with just the app product and not the in-app product and the code would be safe.