From f89dda81a6962618208f5f6e04e91c2ac71cc2b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= <mbombeck@gmail.com>
Date: Sun, 13 Sep 2026 14:24:37 +0200
Subject: [PATCH] test: point the prefix drift guard at the shared matcher

The guard read src/lib/idempotency.ts for the hle_ prefix, which moved to src/lib/secret-shape.ts with the matcher. It now asserts that the shared matcher refuses an hle_ token and that the idempotency cache imports and calls it, so a private copy of the pattern would fail it too.
---
 src/lib/auth/__tests__/step-up.test.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/lib/auth/__tests__/step-up.test.ts b/src/lib/auth/__tests__/step-up.test.ts
index f37365ddb..ad8c33da1 100644
--- a/src/lib/auth/__tests__/step-up.test.ts
+++ b/src/lib/auth/__tests__/step-up.test.ts
@@ -172,8 +172,16 @@ describe("the credential prefix lists do not drift apart", () => {
     // Two parallel denylists guard the same class of value. They were already
     // one prefix out of step (`hls_` was in one and not the other), which is
     // how the next one gets missed.
+    // The cache refuses through the shared matcher, so the matcher is what
+    // has to know the prefix, and the cache has to be using it rather than a
+    // private copy of the pattern.
+    const { looksSecretShaped } = await import("@/lib/secret-shape");
+    expect(looksSecretShaped(`elevation=hle_${"a".repeat(64)}`)).toBe(true);
     const idempotency = readFileSync("src/lib/idempotency.ts", "utf8");
-    expect(idempotency).toContain("hle_");
+    expect(idempotency).toMatch(
+      /import \{ looksSecretShaped \} from "@\/lib\/secret-shape"/,
+    );
+    expect(idempotency).toMatch(/looksSecretShaped\(text\)/);
 
     const { redactSecrets } = await import("@/lib/logging/redact");
     const secret = `hle_${"a".repeat(64)}`;