hashers

var ErrHashMismatch = errors.New("hash mismatch")

var PBKDF2Pattern = regexp.MustCompile(`^\$pbkdf2-sha512\$20000\$\$[A-Za-z0-9./]{86}$`)

PBKDF2Pattern matches the one string Doorkeeper's Pbkdf2Sha512 strategy stored for refresh tokens from 2022-09 and application secrets from 2023-01, until the sha512_oauth rollout in 2025-09: 20000 rounds, an empty salt, and the 64-byte digest as 86 passlib base64 chars ('.' for '+', no padding). gitlab-rails never wrote another shape (gitlab-org/gitlab#632068, note 4068971162).

var SHA512HexPattern = regexp.MustCompile(`^[0-9a-f]{128}$`)

SHA512HexPattern matches a SHA-512 digest as 128 lowercase hex characters, the form Doorkeeper stores (Digest::SHA512.hexdigest). A Doorkeeper plaintext is 64 hex chars (SecureRandom.hex(32)), so an accidentally-sent plaintext fails the match instead of being stored as a digest.