<?php

declare(strict_types=1);

namespace GNexus\GAuth\OAuth;

final class PkceGenerator
{
    public static function generateVerifier(int $bytes = 64): string
    {
        return self::base64UrlEncode(random_bytes($bytes));
    }

    public static function generateChallenge(string $verifier): string
    {
        return self::base64UrlEncode(hash('sha256', $verifier, true));
    }

    public static function generateState(int $bytes = 32): string
    {
        return self::base64UrlEncode(random_bytes($bytes));
    }

    private static function base64UrlEncode(string $value): string
    {
        return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
    }
}