using System;
using System.Security.Cryptography;
using System.Text;

namespace ManagerService.Helpers
{
    /// <summary>
    /// Generic token mechanism shared by the "set initial password" (onboarding welcome email),
    /// "invite user" and "forgot password" flows. The raw token is only ever sent by email —
    /// only its SHA-256 hash is stored on <see cref="Data.User.PasswordTokenHash"/>.
    /// </summary>
    public static class PasswordTokenHelper
    {
        private static readonly TimeSpan DefaultValidity = TimeSpan.FromHours(48);

        public static string GenerateRawToken() => PasswordUtils.GetUniqueKey(40);

        public static string Hash(string rawToken)
        {
            var bytes = Encoding.UTF8.GetBytes(rawToken);
            var hash = SHA256.HashData(bytes);
            return Convert.ToHexString(hash).ToLowerInvariant();
        }

        public static DateTime DefaultExpiry() => DateTime.UtcNow.Add(DefaultValidity);
    }
}