src/utils/voucherCode.js

const crypto = require("crypto");

// Excludes visually-confusable characters (0/O, 1/I/L) since these codes
// are meant to be read aloud, typed by hand, or printed on a certificate.
const ALPHABET = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";

function randomSegment(length) {
  let out = "";
  const bytes = crypto.randomBytes(length);
  for (let i = 0; i < length; i++) {
    out += ALPHABET[bytes[i] % ALPHABET.length];
  }
  return out;
}

/** e.g. AYN-7K4Q-XP2M — grouped for readability, not a security boundary by itself. */
function generateVoucherCode() {
  return `AYN-${randomSegment(4)}-${randomSegment(4)}`;
}

module.exports = { generateVoucherCode };