tests/unit/test_utils_crypto.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import re
+from unittest.mock import patch
 
 from devx.utils.crypto import (
     _DIGITS,
@@ -35,6 +36,13 @@ class TestGenerateSecret:
             assert "+" not in secret
             assert "/" not in secret
 
+    def test_retries_on_leading_dash(self) -> None:
+        """When token_urlsafe returns a value starting with '-', it retries."""
+        # First call returns a dash-prefixed value, second returns a clean one
+        with patch("devx.utils.crypto.secrets.token_urlsafe", side_effect=["-bad-value", "good-value"]):
+            secret = generate_secret()
+        assert secret == "good-value"
+
 
 class TestGeneratePassword:
     def test_default_length(self) -> None: