"""
认证工具 (auth)
模块: 服务端 / 认证
输入: 明文密码
输出: pbkdf2 哈希 / 随机 token

标准库实现 (pbkdf2-hmac-sha256, 20 万轮迭代), 不引第三方
密码不落库: 只存 salt$hash
"""

import hashlib
import hmac
import secrets

_ITERATIONS = 200_000


def hash_password(password: str) -> str:
    """密码 -> 'salt$hash' (pbkdf2-hmac-sha256, 随机盐)"""
    salt = secrets.token_hex(16)
    dk = hashlib.pbkdf2_hmac(
        "sha256", password.encode("utf-8"), bytes.fromhex(salt), _ITERATIONS
    )
    return f"{salt}${dk.hex()}"


def verify_password(password: str, stored: str) -> bool:
    """校验明文密码与存储哈希 (常数时间比较)"""
    try:
        salt, expected = stored.split("$", 1)
        dk = hashlib.pbkdf2_hmac(
            "sha256", password.encode("utf-8"), bytes.fromhex(salt), _ITERATIONS
        )
        return hmac.compare_digest(dk.hex(), expected)
    except ValueError:
        return False


def new_token() -> str:
    """随机 token (32 字节 hex, 会话凭证)"""
    return secrets.token_hex(32)