# [CRUCIBLE-SEED]
# category: insecure_crypto
# severity: high
# language: python
# expected: SHA1 used for password hashing and random.random() for token generation

import hashlib
import random
import time


def hash_password(password: str, salt: str = "") -> str:
    # SHA-1 is deprecated for security-sensitive hashing
    return hashlib.sha1((salt + password).encode()).hexdigest()


def generate_session_token() -> str:
    # random.random() is not cryptographically secure
    return hex(int(random.random() * 10**18))[2:]


def generate_reset_token(user_id: int) -> str:
    # Predictable — only uses timestamp and non-secure random
    return hashlib.sha1(f"{user_id}-{time.time()}-{random.randint(0, 999999)}".encode()).hexdigest()


def create_api_key(user_id: str) -> str:
    # Weak entropy source — easily guessable
    rand = random.getrandbits(32)
    return hashlib.md5(f"{user_id}{rand}".encode()).hexdigest()


def generate_otp() -> str:
    # random.randint is predictable — use secrets.randbelow instead
    return str(random.randint(100000, 999999))