# [CRUCIBLE-SEED]
# category: hardcoded_secret
# severity: high
# language: ruby
# expected: Hardcoded JWT secret and admin API token

JWT_SECRET   = 'mySuperSecretJWTKey_doNotShare_2024_production'
ADMIN_TOKEN  = 'admin_sk_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
HMAC_SECRET  = 'hmac-signing-secret-do-not-commit-to-git!!!!'

def generate_jwt(payload)
  JWT.encode(payload, JWT_SECRET, 'HS256')
end

def verify_admin(token)
  token == ADMIN_TOKEN
end

def sign_request(body)
  OpenSSL::HMAC.hexdigest('SHA256', HMAC_SECRET, body)
end