package auth

import (
	"crypto/rand"
	"crypto/sha256"
	"encoding/base64"
)

// GenerateVerifier returns a cryptographically random PKCE verifier (RFC 7636).
// Length is 64 URL-safe characters, within the required [43, 128] range.
func GenerateVerifier() (string, error) {
	b := make([]byte, 48)
	if _, err := rand.Read(b); err != nil {
		return "", err
	}
	return base64.RawURLEncoding.EncodeToString(b), nil
}

// ChallengeS256 returns the S256 PKCE challenge for the given verifier.
// challenge = BASE64URL(SHA256(ASCII(verifier)))
func ChallengeS256(verifier string) string {
	h := sha256.Sum256([]byte(verifier))
	return base64.RawURLEncoding.EncodeToString(h[:])
}