(t *testing.T)
| 9 | ) |
| 10 | |
| 11 | func TestHashOTP_RoundTrip(t *testing.T) { |
| 12 | const key = "test-jwt-secret" |
| 13 | const plain = "123456" |
| 14 | |
| 15 | hashed := HashOTP(plain, key) |
| 16 | |
| 17 | // Hex digest of HMAC-SHA256 is always 64 chars (32 bytes * 2) |
| 18 | require.Len(t, hashed, 64) |
| 19 | // And must not equal the plaintext |
| 20 | assert.NotEqual(t, plain, hashed) |
| 21 | |
| 22 | // Verify with the original plaintext succeeds |
| 23 | assert.True(t, VerifyOTPHash(plain, hashed, key)) |
| 24 | // Verifying with the digest itself MUST fail — otherwise the digest |
| 25 | // becomes a usable credential for anyone with DB read access. |
| 26 | assert.False(t, VerifyOTPHash(hashed, hashed, key)) |
| 27 | } |
| 28 | |
| 29 | func TestHashOTP_Deterministic(t *testing.T) { |
| 30 | // Same plaintext + same key must produce the same digest. Otherwise |
nothing calls this directly
no test coverage detected