<?php

namespace Modules\PortalApi\Support;

class VerifyToken
{
    /**
     * Generate a short HMAC signature for a pet's vaccination card verify URL.
     * The QR code encodes /verify/{petId}?sig=<token>; the verify page reads
     * petId from the route and validates ?sig against this signature.
     *
     * APP_KEY is the shared secret. Tokens don't expire — vaccination records
     * are not sensitive to time-of-issue and shouldn't break when shown
     * months after generation (boarding facilities, travel, etc).
     */
    public static function sign(int $petId): string
    {
        $payload = 'verify:' . $petId;
        return substr(hash_hmac('sha256', $payload, config('app.key', 'fallback')), 0, 24);
    }

    public static function verify(int $petId, string $candidate): bool
    {
        if ($candidate === '') {
            return false;
        }
        return hash_equals(self::sign($petId), $candidate);
    }
}
