Address potential weaknesses source of join-code generation

lib/join_code_generator.rb

@@ -1,19 +1,18 @@
 # frozen_string_literal: true
 
+require 'securerandom'
+
 class JoinCodeGenerator
   # Omit K, X, Z — commonly confused or offensive in short codes.
   CONSONANTS = %w[B C D F G H J L M N P Q R S T V W Y].freeze
 
   # Format: CDDD-CDDD (e.g., B123-C456). C = consonant from CONSONANTS, D = digit.
   FORMAT_REGEX = Regexp.new("\\A(?:#{CONSONANTS.join('|')})\\d{3}-(?:#{CONSONANTS.join('|')})\\d{3}\\z").freeze
 
-  cattr_accessor :random
-
-  self.random ||= Random.new
-
   def self.generate
     seg = lambda do
-      "#{CONSONANTS.sample(random: random)}#{format('%03d', random.rand(1000))}"
+      consonant = CONSONANTS[SecureRandom.random_number(CONSONANTS.length)]
+      "#{consonant}#{format('%03d', SecureRandom.random_number(1000))}"
     end
 
     "#{seg.call}-#{seg.call}"

spec/lib/join_code_generator_spec.rb

@@ -7,6 +7,15 @@
     it 'matches CDDD-CDDD' do
       expect(described_class.generate).to match(described_class::FORMAT_REGEX)
     end
+
+    it 'uses SecureRandom for each code component' do
+      allow(SecureRandom).to receive(:random_number).with(described_class::CONSONANTS.length).and_return(0, 1)
+      allow(SecureRandom).to receive(:random_number).with(1000).and_return(123, 456)
+
+      expect(described_class.generate).to eq('B123-C456')
+      expect(SecureRandom).to have_received(:random_number).with(described_class::CONSONANTS.length).twice
+      expect(SecureRandom).to have_received(:random_number).with(1000).twice
+    end
   end
 
   describe '.normalize' do