Additional fixes and tests for #508 (#509)

* Additional fixes and tests for #508

I didn't fully understand the project and test structure, but while
preparing the backport for v3 I gained a fuller understanding.

The tests now exercise the customAlphabet code and the non-secure
variant, and fix the infinite loop case in `customRandom` on both
node and the browser.

* `const` -> `let`

* lint

index.browser.js

@@ -40,7 +40,7 @@ export let customRandom = (alphabet, defaultSize, getRandom) => {
       while (j--) {
         // Adding `|| ''` refuses a random byte that exceeds the alphabet size.
         id += alphabet[bytes[j] & mask] || ''
-        if (id.length === size) return id
+        if (id.length >= size) return id
       }
     }
   }

index.js

@@ -59,7 +59,7 @@ export function customRandom(alphabet, defaultSize, getRandom) {
       while (i--) {
         // Adding `|| ''` refuses a random byte that exceeds the alphabet size.
         id += alphabet[bytes[i] & mask] || ''
-        if (id.length === size) return id
+        if (id.length >= size) return id
       }
     }
   }

test/index.test.js

@@ -126,6 +126,15 @@ for (let type of ['node', 'browser']) {
       equal(nanoidA(10), 'aaaaaaaaaa')
     })
 
+    test(`${type} / customAlphabet / avoids pool pollution, infinite loop`, () => {
+      let ALPHABET = 'abcdefghijklmnopqrstuvwxyz'
+      let nanoid2 = customAlphabet(ALPHABET)
+      nanoid2(2.1)
+      let second = nanoid2()
+      let third = nanoid2()
+      notEqual(second, third)
+    })
+
     test(`${type} / customRandom / supports generator`, () => {
       let sequence = [2, 255, 3, 7, 7, 7, 7, 7, 0, 1]
       function fakeRandom(size) {

test/non-secure.test.js

@@ -1,4 +1,4 @@
-import { equal, match, ok } from 'node:assert'
+import { equal, match, notEqual, ok } from 'node:assert'
 import { describe, test } from 'node:test'
 
 import { urlAlphabet } from '../index.js'
@@ -57,6 +57,13 @@ describe('non secure', () => {
     ok(max - min <= 0.05)
   })
 
+  test('nanoid / avoids pool pollution, infinite loop', () => {
+    nanoid(2.1)
+    let second = nanoid()
+    let third = nanoid()
+    notEqual(second, third)
+  })
+
   test('customAlphabet / has options', () => {
     let nanoidA = customAlphabet('a', 5)
     equal(nanoidA(), 'aaaaa')
@@ -88,4 +95,13 @@ describe('non secure', () => {
     }
     ok(max - min <= 0.05)
   })
+
+  test('customAlphabet / avoids pool pollution, infinite loop', () => {
+    let ALPHABET = 'abcdefghijklmnopqrstuvwxyz'
+    let nanoid2 = customAlphabet(ALPHABET)
+    nanoid2(2.1)
+    let second = nanoid2()
+    let third = nanoid2()
+    notEqual(second, third)
+  })
 })