From 39e0ced68db0fcc92b355e1be20ffaab020bf05f Mon Sep 17 00:00:00 2001 From: Abhigyan Patwari <126312502+abhigyanpatwari@users.noreply.github.com> Date: Sun, 18 Oct 2026 18:13:33 +0530 Subject: [PATCH] test(server): make the opaque repo id assertion deterministic (#3625) `publicRepoId` is an HMAC under a key drawn once per process (`randomBytes(32)`), so the 22-character base64url id is effectively random on every run. The test asserted `not.toContain('ws')` to show the id does not leak the path, but any id contains "ws" by chance with probability 21/4096 (~0.5%). CI hit it on #3624 with `gt5f4oNtpcwsi6vep8lzQN`. Across 20,000 fresh keys the old assertion failed 118 times and the new one 0 times. The test now checks the base64url shape and that the full path is absent; '/' is outside the alphabet, so a chance match cannot happen. Co-authored-by: Gergo Magyar Co-authored-by: Claude Opus 5.5 --- gitnexus/test/unit/repo-projection.test.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/gitnexus/test/unit/repo-projection.test.ts b/gitnexus/test/unit/repo-projection.test.ts index 86eda3e00..cc8191e97 100644 --- a/gitnexus/test/unit/repo-projection.test.ts +++ b/gitnexus/test/unit/repo-projection.test.ts @@ -119,7 +119,12 @@ describe('projectRepoListEntry — GET /api/repos', () => { const b = projectRepoListEntry(entry({ name: 'api', path: '/ws/b/api' }), FRESH, FULL_SOURCE); expect(a.id).not.toBe(b.id); expect(a.id).toBe(publicRepoId('/ws/a/api')); - expect(a.id).not.toContain('ws'); + // The id is an HMAC under a per-process random key, so a short substring + // such as 'ws' appears in it by chance (~0.5% of runs). Assert the opaque + // base64url shape instead; '/' is outside that alphabet, so the path can + // never appear in the id by chance. + expect(a.id).toMatch(/^[A-Za-z0-9_-]{22}$/); + expect(a.id).not.toContain('/ws/a/api'); }); it('keeps every field the route returned before, unchanged', () => {