op-vault: test that a token is independent of the PAN, not free of "4242" #126

Merged

dcharlot merged 1 commit from openpay/token-independence-test into main 2026-10-01 06:02:36 -04:00

Conversation 0 Commits 1 Files changed 1 +16 -4

dcharlot commented 2026-09-30 23:08:06 -04:00

Owner

Copy link

pan_never_appears_in_token_string failed the openpay leg of standards-build on #102, which touches nothing in openpay.

Cause. The test asserted that the token never contains "424242" or "4242". A token is TOKEN_PREFIX plus a UUIDv7 in hex. A random hex string contains "4242" now and then: 23 of 200,000 UUIDv7s did, about 1 in 8,700. Any PR whose openpay leg runs can hit this. The timestamp part of the token at CI time (01a0f4ee2960) has no 4242 in it, so the match came from the random suffix.

Fix. Keep the full-PAN check. Replace the substring checks with the property they were meant to stand for: the same card tokenized twice gets two different tokens, and neither contains the PAN. A missing substring never showed that the token isn't derived from the card. Two different tokens for one card does show it.

Verified.

• cargo test -p op-vault --features in-memory: 40 + 11 passed.
• The test passed 300 runs out of 300 in a loop.
• Without --features in-memory the lifecycle binary has 0 tests. CI's openpay leg does enable the feature, which is why it failed there.

🤖 Generated with Claude Code

`pan_never_appears_in_token_string` failed the openpay leg of standards-build on #102, which touches nothing in openpay. **Cause.** The test asserted that the token never contains `"424242"` or `"4242"`. A token is `TOKEN_PREFIX` plus a UUIDv7 in hex. A random hex string contains `"4242"` now and then: 23 of 200,000 UUIDv7s did, about 1 in 8,700. Any PR whose openpay leg runs can hit this. The timestamp part of the token at CI time (`01a0f4ee2960`) has no `4242` in it, so the match came from the random suffix. **Fix.** Keep the full-PAN check. Replace the substring checks with the property they were meant to stand for: the same card tokenized twice gets two different tokens, and neither contains the PAN. A missing substring never showed that the token isn't derived from the card. Two different tokens for one card does show it. **Verified.** - `cargo test -p op-vault --features in-memory`: 40 + 11 passed. - The test passed 300 runs out of 300 in a loop. - Without `--features in-memory` the lifecycle binary has 0 tests. CI's openpay leg does enable the feature, which is why it failed there. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-09-30 23:08:06 -04:00

op-vault: test that a token is independent of the PAN, not free of "4242" ... f4ac4a70c9

pan_never_appears_in_token_string asserted that the token never contains
"424242" or "4242". The token is TOKEN_PREFIX plus a UUIDv7 in hex, and a
random hex string contains "4242" about once in 8,700 tokens (23 of
200,000 UUIDv7s did), so the test failed by chance: it failed the
openpay leg of standards-build on an unrelated PR (#102). A missing
substring said nothing about whether the token is derived from the card
anyway.

Keep the full-PAN check and test the real property: the same card
tokenized twice gets two different tokens, neither containing the PAN.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 726d53b015 into main 2026-10-01 06:02:36 -04:00

dcharlot referenced this pull request from a commit 2026-10-01 06:02:38 -04:00

Merge pull request 'op-vault: test that a token is independent of the PAN, not free of "4242"' (#126) from openpay/token-independence-test into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!126

No description provided.