import { createHash, randomBytes } from "node:crypto";

/** How long a freshly issued email-verification link stays valid. */
export const EMAIL_VERIFICATION_TTL_MS = 24 * 60 * 60 * 1000;

/** 256 bits of randomness, hex-encoded — not guessable, never derived from user data. */
export function generateVerificationToken(): string {
  return randomBytes(32).toString("hex");
}

/**
 * Only this hash is ever persisted (see collections/Customers.ts) — the
 * plaintext token exists only in the URL sent by email and briefly in
 * memory while that email is being sent.
 */
export function hashVerificationToken(token: string): string {
  return createHash("sha256").update(token).digest("hex");
}

export function verificationExpiryISO(): string {
  return new Date(Date.now() + EMAIL_VERIFICATION_TTL_MS).toISOString();
}