import { timingSafeEqual } from "node:crypto";
import { deriveCsrfToken as deriveStoredCsrfToken } from "./session-store.js";

export { deriveStoredCsrfToken as deriveCsrfToken };

/** Compare a client-supplied CSRF value without exposing a useful length timing oracle. */
export function csrfTokensEqual(expectedToken: string, suppliedToken: string | undefined): boolean {
  const expected = Buffer.from(expectedToken, "utf8");
  const supplied = Buffer.from(suppliedToken ?? "", "utf8");
  const padded = Buffer.alloc(expected.length);
  supplied.copy(padded, 0, 0, expected.length);
  return timingSafeEqual(expected, padded) && supplied.length === expected.length;
}