import crypto from 'crypto';

export function hashPassword(password: string) {
  const salt = crypto.randomBytes(16).toString('hex');
  const iterations = 120000;
  const keylen = 32;
  const digest = 'sha256';
  const derivedKey = crypto.pbkdf2Sync(password, salt, iterations, keylen, digest).toString('hex');
  return `${iterations}:${salt}:${derivedKey}`;
}

export function verifyPassword(password: string, stored: string) {
  const parts = stored.split(':');
  if (parts.length !== 3) return false;
  const iterations = Number(parts[0]);
  const salt = parts[1];
  const expectedHex = parts[2];
  if (!Number.isFinite(iterations) || iterations <= 0) return false;
  const keylen = Buffer.from(expectedHex, 'hex').length;
  if (keylen <= 0) return false;
  const actual = crypto.pbkdf2Sync(password, salt, iterations, keylen, 'sha256');
  const expected = Buffer.from(expectedHex, 'hex');
  if (actual.length !== expected.length) return false;
  return crypto.timingSafeEqual(actual, expected);
}