import { createHash } from "node:crypto";

/**
 * Produces a stable, irreversible token for a GDPR-erased actorId.
 *
 * Format: `erased-<first-16-hex-chars-of-sha256(salt:actorId)>`
 *
 * The salt is read from `AUDIT_PSEUDONYM_SALT` env at call time so that
 * production binding can pre-validate the var at boot (see `bindAudit`)
 * while tests can override it per-test via `process.env`.
 *
 * Fallback salt is intentionally weak and labelled so that any token
 * produced with it is recognisable as a dev/test artefact.
 */
export function pseudonymize(actorId: string): string {
  const salt =
    process.env["AUDIT_PSEUDONYM_SALT"] ?? "dev-fallback-salt-replace-in-prod";
  const hash = createHash("sha256")
    .update(`${salt}:${actorId}`)
    .digest("hex");
  return `erased-${hash.slice(0, 16)}`;
}