"""Argon2-based secret generation and login URL construction."""

from __future__ import annotations

import secrets
from urllib.parse import quote

from argon2 import PasswordHasher

_ph = PasswordHasher()

_SECRET_BYTES = 32


def generate_secret() -> str:
    """Return a fresh random secret (URL-safe, 32 bytes)."""
    return secrets.token_urlsafe(_SECRET_BYTES)


def hash_secret(raw_secret: str) -> str:
    """Return an Argon2 hash of *raw_secret*."""
    return _ph.hash(raw_secret)


def build_login_url(base_url: str, raw_secret: str) -> str:
    """Concatenate *base_url* with the URL-encoded Argon2 hash of *raw_secret*.

    The hash is percent-encoded so that ``$`` and other special characters
    are safe inside a query-string value.
    """
    return f"{base_url}{quote(hash_secret(raw_secret), safe='')}"
