import { createHash, randomBytes } from "node:crypto";

/**
 * Secure signer link token — eden.md §10.1-10.2. Plain SHA-256 (not
 * HMAC, unlike OTP): the token already has 256 bits of entropy, so
 * there's no small-search-space to defend against with a server secret —
 * simple hash suffices. Never search by the plaintext token; only ever
 * by its hash.
 */
export const SIGNER_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;

export function generateSignerToken(): string {
  return randomBytes(32).toString("hex");
}

export function hashSignerToken(token: string): string {
  return createHash("sha256").update(token).digest("hex");
}