"""Token and session helpers."""

import hmac
import secrets

_SESSIONS: dict[str, str] = {}


def new_token() -> str:
    """Generate an opaque session token."""
    return secrets.token_urlsafe(32)


def verify_token(supplied: str, expected: str) -> bool:
    """Constant-time token comparison."""
    return hmac.compare_digest(supplied, expected)


def login(user_id: str) -> str:
    token = new_token()
    _SESSIONS[token] = user_id
    return token


def user_for_token(token: str) -> str | None:
    return _SESSIONS.get(token)