import { createHmac, randomBytes } from "node:crypto";
import { createLogger } from "@open-mercato/shared/lib/logger";
const logger = createLogger("auth").child({ component: "token-hash" });
const DEV_ONLY_SECRET = "om-auth-token-dev-only-secret";
let missingSecretWarned = false;
function resolveTokenSecret() {
  const secret = process.env.AUTH_TOKEN_SECRET || process.env.AUTH_SECRET || process.env.NEXTAUTH_SECRET || process.env.JWT_SECRET;
  if (!secret) {
    if (process.env.NODE_ENV === "production") {
      throw new Error(
        "[auth.tokenHash] No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set. Refusing to start in production without a token hashing secret."
      );
    }
    if (!missingSecretWarned) {
      missingSecretWarned = true;
      logger.warn("No AUTH_TOKEN_SECRET/AUTH_SECRET/NEXTAUTH_SECRET/JWT_SECRET set \u2014 using insecure dev-only default. Set a secret before deploying to production.");
    }
    return DEV_ONLY_SECRET;
  }
  return secret;
}
function generateAuthToken() {
  return randomBytes(32).toString("hex");
}
function hashAuthToken(rawToken) {
  return createHmac("sha256", resolveTokenSecret()).update(rawToken).digest("hex");
}
export {
  generateAuthToken,
  hashAuthToken
};
//# sourceMappingURL=tokenHash.js.map
