// Package passwordhash owns side-effect-free password hash primitives. It is
// deliberately separate from session/JWT initialization so non-auth Runtime
// engines can validate persisted hashes without acquiring token-key ownership.
package passwordhash

import (
	apperrors "github.com/nexuscrm/kernel/pkg/errors"
	"golang.org/x/crypto/bcrypt"
)

func Hash(password string) (string, error) {
	value, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	return string(value), err
}

func Verify(password, hash string) bool {
	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) == nil
}

func ValidateCost(hash string) error {
	cost, err := bcrypt.Cost([]byte(hash))
	if err != nil {
		return apperrors.NewValidationError("password", "malformed bcrypt hash")
	}
	if cost < bcrypt.DefaultCost {
		return apperrors.NewValidationError("password", "pre-computed password hash has insufficient bcrypt cost factor")
	}
	return nil
}