import { createHash, randomBytes } from "node:crypto";
import bcrypt from "bcryptjs";
import { config } from "../config.js";

export function randomToken(bytes = 32): string {
  return randomBytes(bytes).toString("base64url");
}

export function sha256(value: string): string {
  return createHash("sha256").update(value).digest("hex");
}

export async function hashPassword(plain: string): Promise<string> {
  return bcrypt.hash(plain, config.bcryptRounds);
}

export async function verifyPassword(plain: string, hash: string): Promise<boolean> {
  return bcrypt.compare(plain, hash);
}

export function clientIp(req: { ip?: string | undefined; socket?: { remoteAddress?: string } }): string | null {
  const raw = req.ip ?? req.socket?.remoteAddress ?? null;
  if (!raw) return null;
  // Normalize IPv6-mapped IPv4 (express may give ::ffff:127.0.0.1)
  return raw.replace(/^::ffff:/, "");
}