From 7a004f782e90db40e054dda84b758f62922ca2c9 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 16 Mar 2026 09:03:54 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=A7=AA=20Add=20unit=20test=20for=20hash?=
 =?UTF-8?q?=5Ftoken=20function?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a specific unit test `test_hash_token_known_value` to `tests/test_api_tokens.py` to assert that the `hash_token` pure function accurately computes the expected PBKDF2 digest for a known input string. This provides a hard check against any accidental regressions to the cryptographic hashing logic, iteration counts, or salt values used.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 tests/test_api_tokens.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tests/test_api_tokens.py b/tests/test_api_tokens.py
index 331631b7..44ff55d6 100644
--- a/tests/test_api_tokens.py
+++ b/tests/test_api_tokens.py
@@ -554,3 +554,13 @@ class TestTokenUtils:
         # All characters should be valid lowercase hex digits.
         int(h, 16)
         assert h == h.lower()
+
+    @pytest.mark.unit
+    def test_hash_token_known_value(self):
+        """hash_token should return the exact expected PBKDF2 digest for a known input."""
+        from app.api.api_tokens import hash_token
+
+        # PBKDF2-HMAC-SHA256 with 100,000 iterations and salt b"api-token-v1"
+        token = "de_test_token_value"
+        expected_hash = "9b89d9adf2f390c75bf2fd0ff2bb5622ef5a9dce438354cce6e39f2f5401129e"
+        assert hash_token(token) == expected_hash