tests and eurc

tests/ShouldMintOrderTokens/main.cpp

@@ -0,0 +1,49 @@
+/*
+catcrafts.net
+Copyright (C) 2026 Catcrafts
+
+The source code of this website is made available for viewing purposes only.
+No permission is granted to copy, modify, distribute, or create derivative works.
+*/
+
+// Order tokens and the human-facing references derived from them. The token
+// is the only credential an order page has, so its shape check is a security
+// boundary: anything that is not exactly 32 lowercase hex characters must
+// never reach a lookup.
+
+import std;
+import Catcrafts.Shared;
+import Catcrafts.Server;
+
+using namespace Catcrafts;
+
+namespace {
+
+int failures = 0;
+
+void Check(bool ok, std::string_view what, std::string_view got = {}) {
+    if (ok) return;
+    ++failures;
+    std::println(std::cerr, "FAIL: {}{}{}", what,
+                 got.empty() ? "" : "  got: ", got);
+}
+
+} // namespace
+
+int main() {
+    Check(IsOrderToken("0123456789abcdef0123456789abcdef"), "token: valid shape");
+    Check(!IsOrderToken("0123456789ABCDEF0123456789ABCDEF"), "token: uppercase rejected");
+    Check(!IsOrderToken("0123456789abcdef0123456789abcde"), "token: short rejected");
+    Check(!IsOrderToken("0123456789abcdef0123456789abcdeg"), "token: non-hex rejected");
+    const std::string tok = Server::NewOrderToken();
+    Check(IsOrderToken(tok), "token: generator emits valid tokens", tok);
+    Check(Server::NewOrderToken() != tok, "token: not constant");
+    Check(Server::ReferenceFromToken("abcdef0123456789abcdef0123456789") == "CC-ABCDEF",
+          "reference: derived and uppercased");
+
+    if (failures != 0) {
+        std::println(std::cerr, "{} check(s) failed", failures);
+        return 1;
+    }
+    return 0;
+}