import * as plugins from '../plugins.js';
import { deriveScramVerifier } from '@push.rocks/smartmta';
import type { ISmtpScramVerifier } from '@push.rocks/smartmta';

/**
 * Derive an RFC 5802 SCRAM-SHA-256 verifier from a plaintext password using
 * smartmta's canonical exported derivation (fresh random salt, OWASP-aligned
 * default iteration count) — the exact algorithm the server verifies at AUTH
 * time. Only the verifier is ever persisted; the plaintext is shown once at
 * create/rotate time and then discarded.
 */
export function deriveSmtpScramVerifier(
  password: string,
  iterations?: number,
): ISmtpScramVerifier {
  return deriveScramVerifier(password, iterations);
}

/**
 * Machine-generated SMTP account password (~192 bits of entropy). Shown once.
 */
export function generateSmtpAccountPassword(): string {
  return plugins.crypto.randomBytes(24).toString('base64url');
}