// SPDX-License-Identifier: AGPL-3.0-only
// SPDX-FileCopyrightText: Copyright (C) 2026 Catcrafts®

export module Crafter.Review:Crypto;
import std;

// Byte strings are std::string throughout: a digest, a key or a nonce is a
// run of bytes, hex or base64 is text, and both travel through the same APIs
// as the text around them. OpenSSL's libcrypto does the hashing; base64 and
// base32 are written out here because what they refuse, and with which
// message, is pinned.
export namespace Crafter::Review {
    std::string Sha256(std::string_view data);
    std::string Sha1(std::string_view data);
    std::string Md5(std::string_view data);
    // Lowercase hex.
    std::string Sha256Hex(std::string_view data);
    std::string Md5Hex(std::string_view data);

    std::string HmacSha256(std::string_view key, std::string_view data);
    std::string HmacSha1(std::string_view key, std::string_view data);
    // PBKDF2-HMAC-SHA256 with a 32-byte result: SCRAM-SHA-256's Hi().
    std::string Pbkdf2Sha256(std::string_view password, std::string_view salt, std::uint32_t iterations);

    // Lowercase, two digits a byte.
    std::string HexEncode(std::string_view bytes);
    // Standard alphabet, padded with '=': base64.b64encode.
    std::string Base64Encode(std::string_view bytes);
    // base64.b64decode(text) without validate=True: characters outside the
    // alphabet are dropped first, then bad padding throws
    // std::invalid_argument, as it raises binascii.Error.
    std::string Base64Decode(std::string_view text);
    // base64.b32decode(text): the RFC 4648 alphabet in upper case, the length
    // a multiple of 8 and the padding one of the five legal amounts; anything
    // else throws std::invalid_argument with binascii's message.
    std::string Base32Decode(std::string_view text);

    // From the kernel's CSPRNG (getrandom): secrets.token_bytes.
    std::string RandomBytes(std::size_t count);
    // secrets.token_hex(count): 2 * count lowercase hex digits.
    std::string TokenHex(std::size_t count);
    // A random (version 4) UUID in its 8-4-4-4-12 form: what `claude
    // --session-id` takes.
    std::string Uuid4();

    // hmac.compare_digest: the time taken does not depend on where the two
    // differ.
    bool ConstantTimeEqual(std::string_view a, std::string_view b);
}