package secrets

import (
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
)

// HashToken returns the SHA-256 hex digest for a bearer token.
func HashToken(token string) string {
	sum := sha256.Sum256([]byte(token))
	return hex.EncodeToString(sum[:])
}

// TokenMatchesHash compares a plaintext token to a stored token hash.
func TokenMatchesHash(token string, expectedHash string) bool {
	actualHash := HashToken(token)
	return subtle.ConstantTimeCompare([]byte(actualHash), []byte(expectedHash)) == 1
}