// Package authkey generates API tokens and derives lookup hashes (no persistence).
package authkey

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
	"fmt"
)

const tokenPrefix = "evobgp_"

// GenerateToken returns a new bearer token (evobgp_ + 32 random bytes, base64url).
func GenerateToken() (string, error) {
	b := make([]byte, 32)
	if _, err := rand.Read(b); err != nil {
		return "", fmt.Errorf("authkey: generate token: %w", err)
	}
	return tokenPrefix + base64.RawURLEncoding.EncodeToString(b), nil
}

// HashToken returns SHA-256 of the full token (32 bytes).
func HashToken(token string) []byte {
	sum := sha256.Sum256([]byte(token))
	return sum[:]
}

// Prefix returns the first 8 characters of the token for display.
func Prefix(token string) string {
	if len(token) <= 8 {
		return token
	}
	return token[:8]
}