<?php

declare(strict_types=1);

namespace App\Domain\Auth;

/**
 * SHA-256 hex digest of the entire raw token string (including the
 * `irdb_<kind3>_` prefix). Pure function: deterministic, no side effects,
 * trivially testable.
 *
 * The hash, not the raw token, is what goes into api_tokens.token_hash.
 * DB lookup is by hash; constant-time comparison via hash_equals() is only
 * needed if you ever fall back to a row scan.
 */
final class TokenHasher
{
    public function hash(string $raw): string
    {
        return hash('sha256', $raw);
    }
}
