//! Session and CSRF token generation.

use base64::prelude::{BASE64_URL_SAFE_NO_PAD, Engine as _};

use crate::token::random_32;

/// base64url(32 random bytes), used as the cookie value. The DB stores its sha256.
pub fn new_session_token() -> String {
    BASE64_URL_SAFE_NO_PAD.encode(random_32())
}

pub fn new_csrf_token() -> String {
    BASE64_URL_SAFE_NO_PAD.encode(random_32())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn tokens_are_unique_base64url_of_32_bytes() {
        let a = new_session_token();
        let b = new_csrf_token();
        assert_eq!(a.len(), 43);
        assert_eq!(b.len(), 43);
        assert_ne!(a, b);
        assert!(
            a.bytes()
                .all(|c| c.is_ascii_alphanumeric() || c == b'-' || c == b'_')
        );
    }
}