package auth

import (
	"crypto/rand"
	"encoding/base64"
)

// NewToken returns 32 bytes of cryptographic randomness, base64url-encoded —
// used for session tokens, CSRF tokens, and OIDC state.
func NewToken() string {
	b := make([]byte, 32)
	if _, err := rand.Read(b); err != nil {
		// Same stance as ulid: a process that cannot read crypto/rand must
		// not mint security tokens.
		panic("auth: crypto/rand failed: " + err.Error())
	}
	return base64.RawURLEncoding.EncodeToString(b)
}