/**
 * Two-factor auth service helpers — auth-2fa.
 *
 * Shared logic between enroll, verify, and backup-code routes:
 *   - Magic-link temp session creation and consumption for pending_2fa flows
 *   - Device-trust cookie name and TTL constants
 */

/** Name of the device-trust HttpOnly cookie set after "remember this device". */
export const DEVICE_TRUST_COOKIE_NAME = 'zync_device_trust'

/** Device-trust TTL: 30 days in seconds. */
export const DEVICE_TRUST_TTL_SECONDS = 60 * 60 * 24 * 30

/** Prefix for temp session tokens returned to the client. */
export const PENDING_2FA_TOKEN_PREFIX = 'temp_'

/** Pending 2FA temp session: TTL in seconds (10 minutes). */
export const PENDING_2FA_TTL_SECONDS = 60 * 10

/** KV key prefix for backup-code attempt counting per temp session. */
export const BACKUP_CODE_ATTEMPT_KEY_PREFIX = 'bc_attempts:'

/** Maximum backup-code attempts per temp session before lockout. */
export const BACKUP_CODE_MAX_ATTEMPTS = 5