From 120dbeafb14528c40873c44253b82b589649fc69 Mon Sep 17 00:00:00 2001 From: CaIon Date: Tue, 20 Oct 2026 20:55:20 +0800 Subject: [PATCH] test(security): match the email code only as a whole number The email binding audit test failed now and then because it searched the whole audit JSON for the six-digit code. Audit event and request IDs start with a long run of time digits, so a random code sometimes appeared inside one of them. Treat only a code that no other digit touches as a leak. --- controller/security_account_test.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/controller/security_account_test.go b/controller/security_account_test.go index 809a57921..60c5414e2 100644 --- a/controller/security_account_test.go +++ b/controller/security_account_test.go @@ -645,7 +645,9 @@ func TestSecurityAccountEmailConfirmationAndAudit(t *testing.T) { require.NoError(t, err) assert.Contains(t, string(encoded), "user.binding_bind") assert.NotContains(t, string(encoded), flow.FlowToken) - assert.NotContains(t, string(encoded), newCode) + // Audit event and request IDs are long runs of time digits that can + // contain the six-digit code by chance; only the whole code is a leak. + assert.NotRegexp(t, `(^|\D)`+newCode+`(\D|$)`, string(encoded)) }) } }