Review random string/password generation

- factor password generation into lib/random.Password
- call from appropriate places
- choose appropriate use of random.String vs random.Password

lib/random/random_test.go

@@ -4,10 +4,47 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
-func TestString(t *testing.T) {
+func TestStringLength(t *testing.T) {
 	for i := 0; i < 100; i++ {
-		assert.Equal(t, i, len(String(i)))
+		s := String(i)
+		assert.Equal(t, i, len(s))
+	}
+}
+
+func TestStringDuplicates(t *testing.T) {
+	seen := map[string]bool{}
+	for i := 0; i < 100; i++ {
+		s := String(8)
+		assert.False(t, seen[s])
+		assert.Equal(t, 8, len(s))
+		seen[s] = true
+	}
+}
+
+func TestPasswordLength(t *testing.T) {
+	for i := 0; i <= 128; i++ {
+		s, err := Password(i)
+		require.NoError(t, err)
+		// expected length is number of bytes rounded up
+		expected := i / 8
+		if i%8 != 0 {
+			expected++
+		}
+		// then converted to base 64
+		expected = (expected*8 + 5) / 6
+		assert.Equal(t, expected, len(s), i)
+	}
+}
+
+func TestPasswordDuplicates(t *testing.T) {
+	seen := map[string]bool{}
+	for i := 0; i < 100; i++ {
+		s, err := Password(64)
+		require.NoError(t, err)
+		assert.False(t, seen[s])
+		seen[s] = true
 	}
 }