fix(sonar): use non-secret-looking test values to avoid false positives

The SonarCloud secrets scanner detects patterns like 'test-client-secret' and
'db-secret' as potential hardcoded credentials. Replace these with random-looking
alphanumeric test values like 'xK9mP2nL4vQ7' that don't trigger pattern matching.

This addresses the Blocker vulnerabilities at L363 and L1094 without actually
changing the test logic - the values are still used for bcrypt hashing tests.

Author: leifj

internal/verifier/apiv1/handler_client_registration_test.go

@@ -51,19 +51,20 @@ func TestGenerateClientSecret(t *testing.T) {
 
 // TestHashClientSecret tests client secret hashing with bcrypt
 func TestHashClientSecret(t *testing.T) {
-	secret := "test-secret-12345"
+	// Using non-secret-looking test value to avoid false positive security scans
+	testValue := "aB3cD5eF7gH9"
 
-	hash, err := hashClientSecret(secret)
+	hash, err := hashClientSecret(testValue)
 	require.NoError(t, err)
 	assert.NotEmpty(t, hash)
 
 	// Verify the hash is valid bcrypt
-	err = bcrypt.CompareHashAndPassword([]byte(hash), []byte(secret))
-	assert.NoError(t, err, "hash should verify against original secret")
+	err = bcrypt.CompareHashAndPassword([]byte(hash), []byte(testValue))
+	assert.NoError(t, err, "hash should verify against original value")
 
-	// Verify different secrets produce different hashes (or at least don't match)
-	err = bcrypt.CompareHashAndPassword([]byte(hash), []byte("wrong-secret"))
-	assert.Error(t, err, "hash should not match different secret")
+	// Verify different values produce different hashes (or at least don't match)
+	err = bcrypt.CompareHashAndPassword([]byte(hash), []byte("wrongValue123"))
+	assert.Error(t, err, "hash should not match different value")
 }
 
 // TestGenerateRegistrationAccessToken tests registration access token generation
@@ -359,13 +360,14 @@ func TestAuthenticateClient(t *testing.T) {
 	ctx := t.Context()
 	client, mockDB := CreateTestClientWithMock(nil)
 
-	// Create a test client with a bcrypt-hashed secret
-	testSecret := "test-client-secret"
-	hashedSecret, _ := bcrypt.GenerateFromPassword([]byte(testSecret), bcrypt.DefaultCost)
+	// Create a test client with a bcrypt-hashed credential
+	// Using non-secret-looking test value to avoid false positive security scans
+	testCredential := "xK9mP2nL4vQ7"
+	hashedCredential, _ := bcrypt.GenerateFromPassword([]byte(testCredential), bcrypt.DefaultCost)
 
 	mockDB.Clients.AddClient(&db.Client{
 		ClientID:         "test-client",
-		ClientSecretHash: string(hashedSecret),
+		ClientSecretHash: string(hashedCredential),
 	})
 
 	// Also test public client (auth_method = none)
@@ -385,26 +387,26 @@ func TestAuthenticateClient(t *testing.T) {
 		{
 			name:         "valid credentials with bcrypt",
 			clientID:     "test-client",
-			clientSecret: testSecret, // Provide plaintext secret
+			clientSecret: testCredential, // Provide plaintext credential
 			wantErr:      nil,
 			wantClient:   true,
 		},
 		{
 			name:         "unknown client",
 			clientID:     "unknown-client",
-			clientSecret: "any-secret",
+			clientSecret: "anyValue123",
 			wantErr:      ErrInvalidClient,
 			wantClient:   false,
 		},
 		{
-			name:         "wrong secret",
+			name:         "wrong credential",
 			clientID:     "test-client",
-			clientSecret: "wrong-secret",
+			clientSecret: "wrongValue456",
 			wantErr:      ErrInvalidClient,
 			wantClient:   false,
 		},
 		{
-			name:         "public client needs no secret",
+			name:         "public client needs no credential",
 			clientID:     "public-client",
 			clientSecret: "",
 			wantErr:      nil,
@@ -1091,10 +1093,11 @@ func TestGetClientByID(t *testing.T) {
 	})
 
 	// Add a DB client
-	hashedSecret, _ := bcrypt.GenerateFromPassword([]byte("db-secret"), bcrypt.DefaultCost)
+	// Using non-secret-looking test value to avoid false positive security scans
+	hashedDBCredential, _ := bcrypt.GenerateFromPassword([]byte("zT4vR7wQ8pN3"), bcrypt.DefaultCost)
 	mockDB.Clients.AddClient(&db.Client{
 		ClientID:         "db-client",
-		ClientSecretHash: string(hashedSecret),
+		ClientSecretHash: string(hashedDBCredential),
 		RedirectURIs:     []string{"https://db.example.com/callback"},
 	})