scriptoriumadmin/GitNexus
1
0
Fork 0
mirror of https://github.com/abhigyanpatwari/GitNexus.git synced 2026-10-26 06:02:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

test(server): make the opaque repo id assertion deterministic (#3625)

Browse source 
`publicRepoId` is an HMAC under a key drawn once per process
(`randomBytes(32)`), so the 22-character base64url id is effectively
random on every run. The test asserted `not.toContain('ws')` to show the
id does not leak the path, but any id contains "ws" by chance with
probability 21/4096 (~0.5%). CI hit it on #3624 with
`gt5f4oNtpcwsi6vep8lzQN`.

Across 20,000 fresh keys the old assertion failed 118 times and the new
one 0 times. The test now checks the base64url shape and that the full
path is absent; '/' is outside the alphabet, so a chance match cannot
happen.

Co-authored-by: Gergo Magyar <gergomagyar0@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Abhigyan Patwari 2026-10-18 18:13:33 +05:30 • committed by GitHub
parent 17b056fc79
commit 39e0ced68d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
gitnexus/test/unit/repo-projection.test.ts
View file

@ -119,7 +119,12 @@ describe('projectRepoListEntry — GET /api/repos', () => {
const b = projectRepoListEntry(entry({ name: 'api', path: '/ws/b/api' }), FRESH, FULL_SOURCE);
expect(a.id).not.toBe(b.id);
expect(a.id).toBe(publicRepoId('/ws/a/api'));
expect(a.id).not.toContain('ws');
// The id is an HMAC under a per-process random key, so a short substring
// such as 'ws' appears in it by chance (~0.5% of runs). Assert the opaque
// base64url shape instead; '/' is outside that alphabet, so the path can
// never appear in the id by chance.
expect(a.id).toMatch(/^[A-Za-z0-9_-]{22}$/);
expect(a.id).not.toContain('/ws/a/api');
});
it('keeps every field the route returned before, unchanged', () => {