openpay/crates/op-vault/tests/lifecycle.rs

@@ -151,10 +151,22 @@ fn pan_never_appears_in_token_string() {
 
     // The full PAN must not appear in the token.
     assert!(!token_str.contains(VALID_VISA));
-    // Neither must the BIN or last four (these are NOT PAN, but they
-    // can't be derivable from the token either).
-    assert!(!token_str.contains("424242"));
-    assert!(!token_str.contains("4242"));
+
+    // Nor may the token be derived from the card: the same card tokenized
+    // twice gets two different tokens. (This test used to assert that the
+    // token never contains "4242" or "424242". The token is a UUIDv7 in hex,
+    // and a random hex string does contain "4242" now and then: 23 of 200,000
+    // UUIDv7s did. So it failed by chance, and the absence of a substring
+    // said nothing about derivability anyway.)
+    let again = vault
+        .tokenize(card_visa(), TokenizationPolicy::default())
+        .unwrap();
+    assert_ne!(
+        token_str,
+        again.as_str(),
+        "the same card tokenized twice gave the same token"
+    );
+    assert!(!again.as_str().contains(VALID_VISA));
 }
 
 #[test]