package idp

import (
	"crypto/rand"
	"crypto/sha256"
	"crypto/subtle"
	"encoding/base64"
	"time"
)

func (v *Verifier) newValue(requestExpiry time.Time) (string, []byte, int64) {
	value := make([]byte, valueLength)
	rand.Read(value)
	digest := sha256.Sum256(value)
	expiry := v.deps.now().Add(ValueTTL)
	if requestExpiry.Before(expiry) {
		expiry = requestExpiry
	}
	return base64.RawURLEncoding.EncodeToString(value), digest[:], expiry.UnixMicro()
}

func checkValue(value, wantDigest []byte, expiry int64, now time.Time) error {
	if !now.Before(time.UnixMicro(expiry)) {
		return ErrValueExpired
	}
	digest := sha256.Sum256(value)
	if subtle.ConstantTimeCompare(digest[:], wantDigest) != 1 {
		return ErrValueMismatch
	}
	return nil
}