import hashlib
import hmac
import secrets


def generate_gateway_session_id():
    return 'GWS_' + secrets.token_urlsafe(32)


def hash_gateway_session_id(session_id):
    value = str(session_id or '').strip()
    if not value:
        raise ValueError('gateway_session_id is required')
    return hashlib.sha256(value.encode('utf-8')).hexdigest()


def constant_time_equals(left, right):
    return hmac.compare_digest(str(left or ''), str(right or ''))