import * as jose from 'jose';
const ISSUER = 'actuate-cms';
const AUDIENCE = 'actuate-mfa-pending';
const TTL_SECONDS = 300; // 5 minutes
export async function createMfaPendingToken(payload, secret) {
    const key = new TextEncoder().encode(secret);
    return new jose.SignJWT({ ...payload })
        .setProtectedHeader({ alg: 'HS256' })
        .setIssuedAt()
        .setIssuer(ISSUER)
        .setAudience(AUDIENCE)
        .setExpirationTime(`${TTL_SECONDS}s`)
        .sign(key);
}
export async function verifyMfaPendingToken(token, secret) {
    const key = new TextEncoder().encode(secret);
    const { payload } = await jose.jwtVerify(token, key, {
        issuer: ISSUER,
        audience: AUDIENCE,
    });
    return {
        userId: String(payload.userId ?? ''),
        fingerprint: String(payload.fingerprint ?? ''),
    };
}
/**
 * Compute a stable fingerprint of the request (IP + user-agent). Used so the
 * MFA-pending token can only be redeemed from the same device that completed
 * the password step.
 */
export async function computeRequestFingerprint(ip, userAgent) {
    const data = new TextEncoder().encode(`${ip}::${userAgent ?? ''}`);
    const digest = await crypto.subtle.digest('SHA-256', data);
    return Array.from(new Uint8Array(digest))
        .map((b) => b.toString(16).padStart(2, '0'))
        .join('');
}
//# sourceMappingURL=mfa-pending.js.map