import { createHash, randomBytes } from "node:crypto";

/**
 * Every short-lived, single-use auth token (email verify, password reset,
 * magic link, refresh token) follows the same shape: a high-entropy random
 * value is handed to the user (mailed, or returned in the refresh cookie),
 * and only its SHA-256 hash is ever persisted. A stolen database dump is
 * therefore never enough to impersonate a pending token.
 */
export function generateToken(): string {
  return randomBytes(32).toString("base64url");
}

export function hashToken(token: string): string {
  return createHash("sha256").update(token).digest("hex");
}