From f4ac4a70c9d6bed352c049cf02d7aca7a12934d9 Mon Sep 17 00:00:00 2001 From: Transaction Science Date: Wed, 30 Sep 2026 23:07:55 -0400 Subject: [PATCH] op-vault: test that a token is independent of the PAN, not free of "4242" pan_never_appears_in_token_string asserted that the token never contains "424242" or "4242". The token is TOKEN_PREFIX plus a UUIDv7 in hex, and a random hex string contains "4242" about once in 8,700 tokens (23 of 200,000 UUIDv7s did), so the test failed by chance: it failed the openpay leg of standards-build on an unrelated PR (#102). A missing substring said nothing about whether the token is derived from the card anyway. Keep the full-PAN check and test the real property: the same card tokenized twice gets two different tokens, neither containing the PAN. Co-Authored-By: Claude Opus 5.5 --- openpay/crates/op-vault/tests/lifecycle.rs | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/openpay/crates/op-vault/tests/lifecycle.rs b/openpay/crates/op-vault/tests/lifecycle.rs index f9f29e483..803872fe5 100644 --- a/openpay/crates/op-vault/tests/lifecycle.rs +++ b/openpay/crates/op-vault/tests/lifecycle.rs @@ -151,10 +151,22 @@ fn pan_never_appears_in_token_string() { // The full PAN must not appear in the token. assert!(!token_str.contains(VALID_VISA)); - // Neither must the BIN or last four (these are NOT PAN, but they - // can't be derivable from the token either). - assert!(!token_str.contains("424242")); - assert!(!token_str.contains("4242")); + + // Nor may the token be derived from the card: the same card tokenized + // twice gets two different tokens. (This test used to assert that the + // token never contains "4242" or "424242". The token is a UUIDv7 in hex, + // and a random hex string does contain "4242" now and then: 23 of 200,000 + // UUIDv7s did. So it failed by chance, and the absence of a substring + // said nothing about derivability anyway.) + let again = vault + .tokenize(card_visa(), TokenizationPolicy::default()) + .unwrap(); + assert_ne!( + token_str, + again.as_str(), + "the same card tokenized twice gave the same token" + ); + assert!(!again.as_str().contains(VALID_VISA)); } #[test] -- 2.54.0 (Apple Git-157)