1 files changed, 26 insertions, 0 deletions
diff --git a/internal/controlplane/api_key_test.go b/internal/controlplane/api_key_test.go
new file mode 100644
index 0000000..51a3a7d
--- /dev/null
+++ b/internal/controlplane/api_key_test.go
@@ -0,0 +1,26 @@
+package controlplane
+
+import (
+	"crypto/sha256"
+	"strings"
+	"testing"
+)
+
+func TestGenerateAPIKeySecretReturnsOnlyDisplayFragments(t *testing.T) {
+	raw, prefix, suffix, hash, err := generateAPIKeySecret()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.HasPrefix(raw, "sk-aigw-") || !strings.HasPrefix(raw, strings.TrimSuffix(prefix, "...")) {
+		t.Fatalf("prefix %q does not identify the generated key", prefix)
+	}
+	if len(suffix) != 6 || !strings.HasSuffix(raw, suffix) {
+		t.Fatalf("suffix %q does not identify the generated key", suffix)
+	}
+	if len(prefix)+len(suffix) >= len(raw) {
+		t.Fatal("display fragments reveal the complete key")
+	}
+	if hash != sha256.Sum256([]byte(raw)) {
+		t.Fatal("generated digest does not authenticate the raw key")
+	}
+}