import { createHash, randomBytes, timingSafeEqual } from "node:crypto";

export function createWebhookSecret() { return randomBytes(32).toString("base64url"); }
export function webhookSecretHash(secret: string) { return createHash("sha256").update(secret).digest("hex"); }
export function webhookSecretMatches(secret: string, expectedHash: string | null) {
  if (!expectedHash) return false;
  const actual = Buffer.from(webhookSecretHash(secret), "hex");
  const expected = Buffer.from(expectedHash, "hex");
  return actual.length === expected.length && timingSafeEqual(actual, expected);
}