/**
 * Opaque session tokens. Raw token goes to the cookie; only the SHA-256
 * hash is persisted, so a DB leak yields no usable sessions.
 */
import { createHash, randomBytes } from 'node:crypto';

export function generateSessionToken(): string {
  return randomBytes(64).toString('base64url');
}

export function hashSessionToken(token: string): string {
  return createHash('sha256').update(token).digest('hex');
}
