"""Password hashing and validation utilities.

⚠️ AUTO-GENERATED BY PRISM - DO NOT EDIT
"""

from __future__ import annotations

import re
import secrets

from passlib.context import CryptContext

pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto")


def hash_password(password: str) -> str:
    """Hash a password using bcrypt."""
    return pwd_context.hash(password)


def verify_password(plain_password: str, hashed_password: str) -> bool:
    """Verify a plain password against a bcrypt hash."""
    return pwd_context.verify(plain_password, hashed_password)


def validate_password_strength(password: str) -> str | None:
    """Validate password meets policy requirements.

    Returns:
        Error message string, or None if valid.
    """
    if len(password) < {{ min_length }}:
        return "Password must be at least {{ min_length }} characters"
{% if require_uppercase %}
    if not re.search(r"[A-Z]", password):
        return "Password must contain at least one uppercase letter"
{% endif %}
{% if require_lowercase %}
    if not re.search(r"[a-z]", password):
        return "Password must contain at least one lowercase letter"
{% endif %}
{% if require_number %}
    if not re.search(r"[0-9]", password):
        return "Password must contain at least one digit"
{% endif %}
{% if require_special %}
    if not re.search(r'[!@#$%^&*(),.?":{}|<>]', password):
        return "Password must contain at least one special character"
{% endif %}
    return None


def generate_token() -> str:
    """Generate a cryptographically secure URL-safe token."""
    return secrets.token_urlsafe(32)
