import { randomBytes, scrypt as scryptCallback, timingSafeEqual } from "node:crypto";
import { promisify } from "node:util";

const scrypt = promisify(scryptCallback);

export async function hashSecret(secret: string) {
  const salt = randomBytes(16).toString("hex");
  const derived = (await scrypt(secret, salt, 64)) as Buffer;
  return `scrypt:${salt}:${derived.toString("hex")}`;
}

export async function verifySecret(secret: string, stored: string) {
  const [algorithm, salt, digest] = stored.split(":");
  if (algorithm !== "scrypt" || !salt || !digest) return false;
  const candidate = (await scrypt(secret, salt, 64)) as Buffer;
  const expected = Buffer.from(digest, "hex");
  return candidate.length === expected.length && timingSafeEqual(candidate, expected);
}

export function generateAccountNumber() {
  const digits = Array.from(randomBytes(10), (byte) => String(byte % 10)).join("");
  return `74${digits.slice(0, 10)}`;
}

export function maskAccountNumber(accountNumber: string) {
  return `••••${accountNumber.slice(-4)}`;
}