From c8fb0016f2d2dd688035b492921e64c25679599f Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 8 Oct 2026 21:56:39 +0200 Subject: [PATCH] Test that a sealed grant hides its words, not two letters The check looked for "rt" in a random base64 ciphertext, which holds it about one time in seventy, and failed mesh-catalog #141's repo check by chance. --- .../cmd/claude-licence-manager/store_test.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/claude-licence-manager/cmd/claude-licence-manager/store_test.go b/modules/claude-licence-manager/cmd/claude-licence-manager/store_test.go index 957fdbfd..30182eeb 100644 --- a/modules/claude-licence-manager/cmd/claude-licence-manager/store_test.go +++ b/modules/claude-licence-manager/cmd/claude-licence-manager/store_test.go @@ -110,7 +110,8 @@ func TestAGrantAtRestOpensOnlyWithItsKey(t *testing.T) { a, _ := NewCrypt("one key") b, _ := NewCrypt("another key") sealed := a.Seal(`{"refreshToken":"rt"}`) - if strings.Contains(sealed, "rt") { + // The plaintext's own words, not two letters a random ciphertext holds one time in about seventy. + if strings.Contains(sealed, "refreshToken") { t.Fatal("stored in the clear") } if got, err := a.Open(sealed); err != nil || got != `{"refreshToken":"rt"}` {