package auth

import (
	"crypto/rand"
	"encoding/base64"
	"fmt"
)

// NewRandomID returns a URL-safe high-entropy identifier.
func NewRandomID() (string, error) {
	buffer := make([]byte, 16)
	if _, err := rand.Read(buffer); err != nil {
		return "", fmt.Errorf("random id: %w", err)
	}
	return base64.RawURLEncoding.EncodeToString(buffer), nil
}