Send hotlink access token hash on upload; keep secret client-side only.

backend/src/utils/hashHotlinkAccessToken.spec.ts

@@ -2,11 +2,17 @@ import { createHash } from 'node:crypto';
 import { hashHotlinkAccessToken } from './hashHotlinkAccessToken';
 
 describe('hashHotlinkAccessToken', () => {
-    it('matches sha256 hex digest of the utf8 access token string', () => {
+    it('returns sha256 hex digest of the utf8 access token string', () => {
         const accessToken = 'test-hotlink-access-token_base64url';
 
         expect(hashHotlinkAccessToken(accessToken)).toBe(
             createHash('sha256').update(accessToken, 'utf8').digest('hex')
         );
     });
+
+    it('returns 64 lowercase hex characters', () => {
+        const hash = hashHotlinkAccessToken('ZWc6ttO-r2qssA_9gdWe6u14X2W0_j7xhRBSVQvfMKI');
+
+        expect(hash).toMatch(/^[a-f0-9]{64}$/);
+    });
 });