<?php

declare(strict_types=1);

namespace WPStack\Sandbox\Security;

final class TokenService
{
    public function __construct(private readonly string $secret)
    {
        if ($secret === '') {
            throw new \InvalidArgumentException('Token secret cannot be empty.');
        }
    }

    public function generate(): string
    {
        return rtrim(strtr(base64_encode(random_bytes(32)), '+/', '-_'), '=');
    }

    public function hash(string $token): string
    {
        return hash_hmac('sha256', $token, $this->secret);
    }

    public function verify(string $token, string $storedHash): bool
    {
        return hash_equals($storedHash, $this->hash($token));
    }
}
