Replaced mollie

tests/ShouldMintOrderTokens/main.cpp

@@ -41,6 +41,70 @@ int main() {
     Check(Server::ReferenceFromToken("abcdef0123456789abcdef0123456789") == "CC-ABCDEF",
           "reference: derived and uppercased");
 
+    // ── the ISO 11649 creditor reference ──────────────────────────────
+    //
+    // The payer's own bank verifies these digits before the transfer leaves,
+    // so a generator that computes them wrong is invisible here and rejected
+    // at every bank in the country. Hence: verify our own output, verify the
+    // verifier rejects tampering, and pin one value literally so a refactor
+    // cannot quietly change the arithmetic.
+    const std::string rf = Server::CreditorReferenceFromToken(
+        "abcdef0123456789abcdef0123456789");
+    Check(Server::IsValidCreditorReference(rf),
+          "creditor ref: generator output verifies", rf);
+    Check(rf.starts_with("RF") && rf.size() == 12,
+          "creditor ref: RF + 2 check digits + CCABCDEF", rf);
+    Check(rf.substr(4) == "CCABCDEF",
+          "creditor ref: body is the human reference without the hyphen", rf);
+    Check(Server::CreditorReferenceFromToken("abcdef0123456789abcdef0123456789") == rf,
+          "creditor ref: derived, so it is stable for one token");
+
+    // The guarantee mod-97-10 actually gives, asserted as the theorem it is
+    // rather than as an empirical count: every single-character substitution
+    // that keeps the character's CLASS is always caught. A letter contributes
+    // two decimal digits (A=10 … Z=35) and a digit contributes one, so a
+    // same-class change shifts the remainder by d*10^k or d*100^k with
+    // |d| < 97; since 97 is prime that product is never ≡ 0, so the checksum
+    // always moves. This is the case that matters — a donor retyping one
+    // character of a reference is stopped by their own bank.
+    //
+    // A change that crosses classes (letter to digit) alters the length of the
+    // decimal expansion and is therefore an ordinary 1-in-97 checksum bet, not
+    // a guarantee. Exactly one such mutation of this reference does slip
+    // through, which is the standard behaving as designed and not a defect;
+    // asserting otherwise would be pinning an accident.
+    int caught = 0, mutations = 0;
+    for (std::size_t i = 2; i < rf.size(); ++i) {
+        const bool isDigit = rf[i] >= '0' && rf[i] <= '9';
+        const std::string_view sameClass =
+            isDigit ? "0123456789" : "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+        for (const char c : sameClass) {
+            if (rf[i] == c) continue;
+            std::string bad = rf;
+            bad[i] = c;
+            ++mutations;
+            if (!Server::IsValidCreditorReference(bad)) ++caught;
+        }
+    }
+    Check(mutations > 0 && caught == mutations,
+          "creditor ref: every same-class one-character change fails verification",
+          std::format("{} of {} caught", caught, mutations));
+
+    Check(!Server::IsValidCreditorReference("RF00CCABCDEF"),
+          "creditor ref: wrong check digits rejected");
+    Check(!Server::IsValidCreditorReference("CCABCDEF"),
+          "creditor ref: missing RF prefix rejected");
+    Check(!Server::IsValidCreditorReference("RF"),
+          "creditor ref: too short rejected");
+    Check(!Server::IsValidCreditorReference(rf + "TOOLONGTOOLONGTOOLONGTOOLONG"),
+          "creditor ref: over 25 characters rejected");
+    Check(!Server::IsValidCreditorReference("RF18CC-ABCDEF"),
+          "creditor ref: non-alphanumeric body rejected");
+    // The canonical example from the standard's own documentation, so this is
+    // pinned against an outside source and not only against ourselves.
+    Check(Server::IsValidCreditorReference("RF18539007547034"),
+          "creditor ref: the published ISO 11649 example verifies");
+
     if (failures != 0) {
         std::println(std::cerr, "{} check(s) failed", failures);
         return 1;