package idear

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/hex"
)

// newToken mints an invitation credential: 32 bytes of crypto/rand,
// hex-encoded (64 characters). The plaintext this returns exists only
// in Invite's return value and the emitted link — only its hash is
// ever persisted; see hashToken.
func newToken() (string, error) {
	b := make([]byte, 32)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	return hex.EncodeToString(b), nil
}

// hashToken digests token with SHA-256, hex-encoded, lowercase. This
// is the only form of the token idear ever writes to the database —
// sessions already holds nothing but digests, and an addon must not
// be laxer than the core it rides on.
func hashToken(token string) string {
	sum := sha256.Sum256([]byte(token))
	return hex.EncodeToString(sum[:])
}