package webapp

import (
	"crypto/rand"
	"encoding/base64"
	"fmt"
)

// GenerateFirstRunPassword returns a fresh random password suitable
// for the worker's first-run webapp credential. The output is 24
// bytes of crypto/rand encoded as URL-safe base64 (no padding), which
// is roughly 32 characters long and safe to print once into the
// worker log.
//
// Phase 1 (MVP) only: a stronger entropy scheme can replace this in
// later phases if needed.
func GenerateFirstRunPassword() (string, error) {
	buf := make([]byte, 24)
	if _, err := rand.Read(buf); err != nil {
		return "", fmt.Errorf("webapp: read random bytes: %w", err)
	}
	return base64.RawURLEncoding.EncodeToString(buf), nil
}

// newSessionID is the underlying primitive for both session cookies
// and CSRF tokens: 32 bytes from crypto/rand, URL-safe base64.
func newSessionID() (string, error) {
	buf := make([]byte, 32)
	if _, err := rand.Read(buf); err != nil {
		return "", fmt.Errorf("webapp: read random bytes: %w", err)
	}
	return base64.RawURLEncoding.EncodeToString(buf), nil
}