use sha2::{Digest, Sha256};

/// SHA-256 hash of `input`, returned as a lowercase hex string.
///
/// Used for API key storage and refresh token tracking — fast enough for
/// randomly-generated long tokens, where Argon2 would be wasteful.
pub fn sha256_hex(input: &str) -> String {
    let mut hasher = Sha256::new();
    hasher.update(input.as_bytes());
    hasher
        .finalize()
        .iter()
        .map(|b| format!("{:02x}", b))
        .collect()
}
