#pragma once

#include <array>
#include <cstddef>
#include <string>
#include <vector>

#include <mw/crypto.hpp>
#include <mw/error.hpp>

/// Raw credential returned once and its SHA-256 digest for persistence.
struct SecretToken
{
    /// Lowercase hexadecimal credential for a URL or cookie.
    std::string value;

    /// SHA-256 digest of the original random bytes.
    std::vector<unsigned char> hash;
};

/// Generate one 256-bit credential and persistence digest.
mw::E<SecretToken> generateSecretToken(mw::CryptoInterface& crypto);

/// Validate, decode, and hash a presented credential.
mw::E<std::vector<unsigned char>> hashSecretToken(const std::string& token);

/// Compare equally sized secret strings without early exit.
bool constantTimeEqual(const std::string& first, const std::string& second);