package de.effigenix.domain.usermanagement;

/**
 * Value Object representing a hashed password.
 * NEVER stores plain-text passwords!
 *
 * The hash should be created using BCrypt with strength 12.
 * Immutable and self-validating.
 */
public record PasswordHash(String value) {

    public PasswordHash {
        if (value == null || value.isBlank()) {
            throw new IllegalArgumentException("PasswordHash cannot be null or empty");
        }
        // BCrypt hashes start with $2a$, $2b$, or $2y$ and are 60 characters long
        if (!value.matches("^\\$2[ayb]\\$.{56}$")) {
            throw new IllegalArgumentException("Invalid BCrypt hash format");
        }
    }

    /**
     * Creates a PasswordHash from a BCrypt hash string.
     * Use PasswordHasher in Infrastructure Layer to create hashes.
     */
    public static PasswordHash of(String bcryptHash) {
        return new PasswordHash(bcryptHash);
    }
}
