hashers

var ErrHashMismatch = errors.New("hash mismatch")

var ErrUnsupportedSecret = errors.New("unsupported client secret digest")

ErrUnsupportedSecret is returned for a stored or wire secret in neither accepted shape. Its message names the shape, never the value.

var PBKDF2Pattern = regexp.MustCompile(`^` + regexp.QuoteMeta(pbkdf2Prefix) + strconv.Itoa(pbkdf2Rounds) + `\$\$[A-Za-z0-9./]{86}$`)

PBKDF2Pattern matches the one string Doorkeeper's Pbkdf2Sha512 strategy stored for refresh tokens from 2022-09 and application secrets from 2023-01, until the sha512_oauth rollout in 2025-09: 20000 rounds, an empty salt, and the 64-byte digest as 86 passlib base64 chars ('.' for '+', no padding). gitlab-rails never wrote another shape: gitlab-org/gitlab#632068 note 4068971162 (refresh tokens) and gitlab-org/gitlab#631544 note 4077807690 (applications).

var SHA512HexPattern = regexp.MustCompile(`^[0-9a-f]{128}$`)

SHA512HexPattern matches a SHA-512 digest as 128 lowercase hex characters, the form Doorkeeper stores (Digest::SHA512.hexdigest). A Doorkeeper plaintext is 64 hex chars (SecureRandom.hex(32)), so an accidentally-sent plaintext fails the match instead of being stored as a digest.