import bcrypt from "bcrypt";

const SALT_ROUNDS = 10;

export async function hashPassword(plain: string) {
  const salt = await bcrypt.genSalt(SALT_ROUNDS);
  return bcrypt.hash(plain, salt);
}

/**
 * Constant-time-ish comparison via bcrypt. Returns false rather than throwing
 * on a malformed/absent hash, so callers can't distinguish "no hash stored"
 * from "wrong password" by catching an exception.
 */
export async function verifyPassword(plain: string, hash: string | null) {
  if (!hash) return false;
  try {
    return await bcrypt.compare(plain, hash);
  } catch {
    return false;
  }
}