/** Parent PIN hashing (scrypt). Light friction gate, not heavy security. */
import crypto from 'node:crypto';

export function hashPin(pin: string): string {
  const salt = crypto.randomBytes(16).toString('hex');
  const derived = crypto.scryptSync(pin, salt, 32).toString('hex');
  return `${salt}:${derived}`;
}

export function verifyPin(pin: string, stored: string | null | undefined): boolean {
  if (!stored) return false;
  const [salt, derived] = stored.split(':');
  if (!salt || !derived) return false;
  const check = crypto.scryptSync(pin, salt, 32).toString('hex');
  const a = Buffer.from(check);
  const b = Buffer.from(derived);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}