/**
 * Backoffice session tokens. Same model as identity: opaque token in the
 * cookie, SHA-256 hash persisted. The two tables/sessions are independent;
 * a leaked backoffice_sessions row yields no usable storefront sessions.
 */
import { createHash, randomBytes } from 'node:crypto';

export function generateBackofficeToken(): string {
  return randomBytes(64).toString('base64url');
}

export function hashBackofficeToken(token: string): string {
  return createHash('sha256').update(token).digest('hex');
}
