(t *testing.T)
| 47 | } |
| 48 | |
| 49 | func TestVerifyOTPHash_WrongKey(t *testing.T) { |
| 50 | const plain = "123456" |
| 51 | stored := HashOTP(plain, "key-a") |
| 52 | |
| 53 | // Same plaintext, different server key → must not verify. This is |
| 54 | // what protects against cross-tenant or cross-deployment leakage. |
| 55 | assert.False(t, VerifyOTPHash(plain, stored, "key-b")) |
| 56 | assert.True(t, VerifyOTPHash(plain, stored, "key-a")) |
| 57 | } |
| 58 | |
| 59 | func TestVerifyOTPHash_DifferentLengthDigest(t *testing.T) { |
| 60 | // Constant-time compare must still return false for differing |
nothing calls this directly
no test coverage detected