import bcrypt
from datetime import datetime, timezone
from jose import jwt
from app.core.config import settings


def hash_pin(plain_pin: str) -> str:
    return bcrypt.hashpw(plain_pin.encode("utf-8"), bcrypt.gensalt(rounds=12)).decode("utf-8")


def verify_pin(plain_pin: str, hashed_pin: str) -> bool:
    return bcrypt.checkpw(plain_pin.encode("utf-8"), hashed_pin.encode("utf-8"))


def create_access_token(staff_id: str, role: str, department_id: str) -> str:
    payload = {
        "sub": str(staff_id),
        "role": role,
        "departmentId": str(department_id),
        "iat": datetime.now(timezone.utc),
    }
    return jwt.encode(payload, settings.JWT_SECRET, algorithm="HS256")