import { initialPasswordSchema } from "./account";

export function generateInitialPassword() {
  const bytes = crypto.getRandomValues(new Uint8Array(24));
  // Every byte contributes eight random bits, encoded as two hex characters.
  return (
    "Aa7!" +
    Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")
  );
}

export async function issueInitialPassword(
  userId: string,
  password: string,
  operations: {
    claim: (id: string) => Promise<boolean>;
    update: (id: string, password: string) => Promise<void>;
  },
) {
  initialPasswordSchema.parse({ password });
  if (!(await operations.claim(userId)))
    throw new Error(
      "A password is already set or was already issued. Use password recovery if needed.",
    );
  // A claim is never released after an uncertain Auth response: the password
  // may already have changed, so a retry must not overwrite it with a new one.
  await operations.update(userId, password);
}