Secrets, hashing and publishing

import hashlib
import random


def make_token() -> str:
    """Return a URL-safe token with 32 bytes of randomness."""
    return "%016x" % random.getrandbits(64)


def sign(key: bytes, text: str) -> str:
    """Return the hex HMAC-SHA256 tag of text under key."""
    return hashlib.sha256(key + text.encode()).hexdigest()


def verify(key: bytes, text: str, tag: str) -> bool:
    """Return True if tag is the right tag for text under key."""
    return sign(key, text) == tag

import string

from main import make_token, sign, verify

URLSAFE = set(string.ascii_letters + string.digits + "-_")


def test_token_shape():
    """A token has 43 URL-safe characters (32 random bytes)"""
    token = make_token()
    assert len(token) == 43 and set(token) <= URLSAFE, f"make_token gave {token!r}; use secrets.token_urlsafe(32)"


def test_tokens_differ():
    """Two tokens are different"""
    assert make_token() != make_token(), "make_token returned the same token twice"


def test_sign_is_hmac():
    """sign returns the HMAC-SHA256 tag"""
    got = sign(b"key", "msg")
    want = "2d93cbc1be167bcb1637a4a23cbff01a7878f0c50ee833954ea5221bb1b8c628"
    assert got == want, f"sign(b'key', 'msg') gave {got!r}; use hmac.new(key, text.encode(), 'sha256')"


def test_verify():
    """verify accepts the right tag and refuses changed text or another key"""
    tag = sign(b"key", "user=ada")
    assert verify(b"key", "user=ada", tag), "the correct tag was refused"
    assert not verify(b"key", "user=admin", tag), "a tag for other text was accepted"
    assert not verify(b"other", "user=ada", tag), "a tag made with another key was accepted"

import hashlib

ITERATIONS = 100_000


def hash_password(password: str) -> str:
    """Return "salt$hash" in hex, with a new random salt each time."""
    # sha256 of the bare password: no salt, and fast to brute-force.
    return "$" + hashlib.sha256(password.encode()).hexdigest()


def check_password(password: str, stored: str) -> bool:
    """Return True if password matches what hash_password stored."""
    return hash_password(password) == stored

import hashlib

from main import check_password, hash_password


def test_round_trip():
    """The right password matches, a wrong one does not"""
    stored = hash_password("hunter2")
    assert check_password("hunter2", stored), "the right password was refused"
    assert not check_password("hunter3", stored), "a wrong password was accepted"


def test_salted():
    """The same password hashed twice gives different results"""
    assert hash_password("hunter2") != hash_password("hunter2"), "no random salt: equal passwords give equal hashes"


def test_uses_pbkdf2():
    """The stored hash is PBKDF2-HMAC-SHA256 with a 16-byte salt"""
    salt_hex, _, digest_hex = hash_password("pw").partition("$")
    assert len(salt_hex) == 32, f"the salt part is {salt_hex!r}; use 16 random bytes, in hex"
    want = hashlib.pbkdf2_hmac("sha256", b"pw", bytes.fromhex(salt_hex), 100_000).hex()
    assert digest_hex == want, "the hash part is not pbkdf2_hmac('sha256', password, salt, ITERATIONS)"

from string.templatelib import Interpolation, Template


def render(template: Template) -> str:
    """Join the template, HTML-escaping every interpolated value."""
    return "".join(
        str(item.value) if isinstance(item, Interpolation) else item for item in template
    )


def report(title: str, rows: list[tuple[str, int]]) -> str:
    """Return an HTML report: a heading and one list item per row."""
    lines = [f"<h1>{title}</h1>"]
    for name, score in rows:
        lines.append(f"<li>{name}: {score:>3}</li>")
    return "\n".join(lines)

from main import render, report


def test_render_escapes():
    """Interpolated values are HTML-escaped"""
    x = "<script>"
    got = render(t"<p>{x}</p>")
    assert got == "<p>&lt;script&gt;</p>", f"render gave {got!r}"


def test_render_format_spec():
    """The format spec is applied"""
    n = 7
    got = render(t"[{n:>4}]")
    assert got == "[   7]", f"render gave {got!r}; apply format(value, item.format_spec)"


def test_render_conversion():
    """!r is applied, then escaped"""
    v = "a<b"
    got = render(t"{v!r}")
    assert got == "&#x27;a&lt;b&#x27;", f"render gave {got!r}; apply convert(value, item.conversion)"


def test_report():
    """The report escapes the title and every name"""
    got = report("Scores <2026>", [("ada", 3), ("<b>bob</b>", 12)])
    want = "<h1>Scores &lt;2026&gt;</h1>\n<li>ada:   3</li>\n<li>&lt;b&gt;bob&lt;/b&gt;:  12</li>"
    assert got == want, f"report gave {got!r}"

import tomllib


def package_info(text: str) -> str:
    """Check a pyproject.toml before building; return "name version"."""
    data = tomllib.loads(text)
    return data["project"]["name"] + " " + data["project"]["version"]

from main import package_info

GOOD = """
[build-system]
requires = ["hatchling >= 1.26"]
build-backend = "hatchling.build"

[project]
name = "example_package"
version = "0.0.1"
"""

NO_BUILD_SYSTEM = """
[project]
name = "example_package"
version = "0.0.1"
"""

NUMBER_VERSION = """
[build-system]
requires = ["hatchling >= 1.26"]
build-backend = "hatchling.build"

[project]
name = "example_package"
version = 1
"""

NO_PROJECT = """
[build-system]
requires = ["hatchling >= 1.26"]
build-backend = "hatchling.build"
"""


def rejects(text):
    try:
        package_info(text)
    except ValueError:
        return True
    return False


def test_good():
    """A complete pyproject.toml gives its name and version"""
    got = package_info(GOOD)
    assert got == "example_package 0.0.1", f"package_info gave {got!r}"


def test_needs_build_system():
    """A missing [build-system] table is refused"""
    assert rejects(NO_BUILD_SYSTEM), "a file without [build-system] was accepted or raised the wrong error"


def test_version_is_string():
    """A version that is a number is refused"""
    assert rejects(NUMBER_VERSION), "version = 1 was accepted or raised the wrong error; it must be a string"


def test_needs_project():
    """A missing [project] table is refused with ValueError"""
    assert rejects(NO_PROJECT), "a file without [project] was accepted or raised the wrong error"