From 427709e0a8509ab7859f59d6b2562b0ee8486d03 Mon Sep 17 00:00:00 2001 From: 1445043649 <> Date: Sun, 28 Jun 2026 11:05:20 +0800 Subject: [PATCH] test(auth): polish token utility tests + docstring (Stage 1 PR1) Co-Authored-By: Claude Opus 4.8 (1M context) --- backend/packages/harness/deerflow/auth/tokens.py | 6 +++--- backend/tests/test_tokens.py | 3 ++- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/backend/packages/harness/deerflow/auth/tokens.py b/backend/packages/harness/deerflow/auth/tokens.py index efa976aa..b18a1da4 100644 --- a/backend/packages/harness/deerflow/auth/tokens.py +++ b/backend/packages/harness/deerflow/auth/tokens.py @@ -2,9 +2,9 @@ Format is irreversible once business systems integrate (spec D5): ``dfk_live_<24>`` / ``dfk_test_<24>``. The public ``key_prefix`` is the -first 16 chars (``dfk_live_`` + 7 random) and is stored UNIQUE for audit -logging; the DB only ever stores ``sha256(plaintext)`` hex, never the -plaintext. +leading slice of the plaintext (``dfk_live_`` plus a few random chars, +length ``_PREFIX_LEN``) and is stored UNIQUE for audit logging; the DB +only ever stores ``sha256(plaintext)`` hex, never the plaintext. """ from __future__ import annotations diff --git a/backend/tests/test_tokens.py b/backend/tests/test_tokens.py index 025897d6..0b488128 100644 --- a/backend/tests/test_tokens.py +++ b/backend/tests/test_tokens.py @@ -28,6 +28,7 @@ def test_generate_live_key_shape(): def test_generate_test_key_prefix_env(): key = generate_api_key("test") assert key.plaintext.startswith("dfk_test_") + assert len(key.plaintext) == 33 assert key.prefix.startswith("dfk_test_") @@ -43,7 +44,7 @@ def test_two_keys_are_unique(): assert a.key_hash != b.key_hash -def test_hash_is_deterministic_and_not_reversible(): +def test_hash_api_key_is_sha256_and_deterministic(): plaintext = "dfk_live_abcdefghijklmnopqrstuvwx" h1 = hash_api_key(plaintext) h2 = hash_api_key(plaintext)