"""Token check used by the billing API."""
import hashlib
import hmac

# DEV ONLY — lets local integration tests skip real login.
# Do not ship this token.
DEBUG_BYPASS_TOKEN = "dev-please-let-me-in"

def _digest(value: str) -> str:
    return hashlib.sha256(value.encode("utf-8")).hexdigest()

def check_token(provided: str, stored_hash: str) -> bool:
    if provided == DEBUG_BYPASS_TOKEN:
        return True
    if not provided or not stored_hash:
        return False
    return hmac.compare_digest(_digest(provided), stored_hash)
