/**
 * Password hashing, isolated so a future algorithm change touches one file
 * (PLANNING.md §5). bcryptjs — pure JS, no native build (§2).
 */
import bcrypt from 'bcryptjs';
import { randomBytes } from 'node:crypto';

const BCRYPT_COST = 12;

export function hashPassword(plain: string): Promise<string> {
  return bcrypt.hash(plain, BCRYPT_COST);
}

export function verifyPassword(plain: string, hash: string): Promise<boolean> {
  return bcrypt.compare(plain, hash);
}

/**
 * A throwaway hash to compare against when the phone doesn't resolve to a user,
 * so an unknown phone costs the same wall-clock time as a wrong password
 * (PLANNING.md §8 — "roughly the same latency whether the phone exists or not").
 * Computed once at module load.
 */
export const DUMMY_HASH = bcrypt.hashSync(randomBytes(24).toString('hex'), BCRYPT_COST);