from hashlib import sha256

_ADMIN_BOOTSTRAP_TOMBSTONE_DOMAIN = (
    b"company-ai-platform:feishu-admin-bootstrap-tombstone:v1\0"
)


def admin_bootstrap_identity_hash(tenant_key: str, open_id: str) -> str:
    """Return a domain-separated digest used only to prevent admin re-grants."""

    tenant_bytes = tenant_key.encode("utf-8")
    open_id_bytes = open_id.encode("utf-8")
    identity = b"".join(
        (
            len(tenant_bytes).to_bytes(4, "big"),
            tenant_bytes,
            len(open_id_bytes).to_bytes(4, "big"),
            open_id_bytes,
        )
    )
    return sha256(_ADMIN_BOOTSTRAP_TOMBSTONE_DOMAIN + identity).hexdigest()