/**
 * Phone number hashing helpers — auth-2fa.
 *
 * We NEVER store raw phone numbers. Only the SHA-256 hex of the E.164 form is
 * persisted (`users.two_factor_phone`). The last 2 digits are stored separately
 * for masked display ("+972 ••••••44").
 *
 * All hashing via crypto.subtle.digest (SHA-256).
 */

/**
 * SHA-256 hex of the E.164 phone number.
 * Deterministic: same input always produces the same 64-char hex string.
 */
export async function hashPhoneE164(phoneE164: string): Promise<string> {
  const digest = await crypto.subtle.digest(
    'SHA-256',
    new TextEncoder().encode(phoneE164),
  )
  return Array.from(new Uint8Array(digest))
    .map((b) => b.toString(16).padStart(2, '0'))
    .join('')
}

/**
 * Return the last 2 digits of a phone number for masked display.
 * E.g. "+972501234567" → "67"
 */
export function phoneSuffix(phoneE164: string): string {
  const digits = phoneE164.replace(/\D/g, '')
  return digits.slice(-2)
}