import { env } from "@/lib/env";
import crypto from "node:crypto";
import { customAlphabet } from "nanoid";

const CIPHER_SECRET = env.GetString("CIPHER_SECRET"); // long, rotated via secrets manager

export interface NewToken {
  token: string;
  publicId: string;
  prefix: string;
  secretHash: Buffer;
}

export function createToken(prefix = "kpat"): NewToken {
  const publicId = customAlphabet("1234567890abcdefghijklmnopqrstuvwxyz", 8)();
  const secret = customAlphabet("1234567890abcdefghijklmnopqrstuvwxyz-", 24)();
  const body = `${prefix}_${publicId}_${secret}`;
  const hmac = crypto
    .createHmac("sha256", CIPHER_SECRET)
    .update(secret)
    .digest();
  return { token: body, publicId, prefix, secretHash: hmac };
}

export function verifySecret(secret: string, secretHash: Buffer): boolean {
  const computed = crypto
    .createHmac("sha256", CIPHER_SECRET)
    .update(secret)
    .digest();
  return crypto.timingSafeEqual(computed, secretHash);
}

export function parseToken(raw: string) {
  const parts = raw.split("_");
  if (parts.length !== 3)
return null;
  const [prefix, publicId, secret] = parts;
  return { prefix, publicId, secret };
}