"""Bootstrap service — first-admin token generation and validation.

⚠️ AUTO-GENERATED BY PRISM - DO NOT EDIT
"""

from __future__ import annotations

import hashlib
import secrets
from datetime import UTC, datetime, timedelta


_BOOTSTRAP_TOKEN_EXPIRY_HOURS = 24


def generate_bootstrap_token() -> tuple[str, str]:
    """Generate a bootstrap token.

    Returns:
        (plain_token, hashed_token) — store hashed_token in the DB,
        give plain_token to the admin once.
    """
    plain = secrets.token_urlsafe(48)
    hashed = hashlib.sha256(plain.encode()).hexdigest()
    return plain, hashed


def hash_bootstrap_token(token: str) -> str:
    """Hash a plain bootstrap token for comparison."""
    return hashlib.sha256(token.encode()).hexdigest()


def is_token_expired(created_at: datetime) -> bool:
    """Check whether a bootstrap token has expired."""
    return datetime.now(UTC) - created_at > timedelta(hours=_BOOTSTRAP_TOKEN_EXPIRY_HOURS)
