import { randomBytes, createHash, randomUUID } from "node:crypto";

// Opaque refresh tokens: a random secret is stored only as a hash server-side.
export function generateRefreshToken(): { token: string; hash: string } {
  const token = randomBytes(48).toString("base64url");
  return { token, hash: hashToken(token) };
}

export function hashToken(token: string): string {
  return createHash("sha256").update(token).digest("hex");
}

export function newId(): string {
  return randomUUID();
}
