Password Reset Token with Oslo and not Lucia

[rwieruch]

The old documentation, if I recall correctly, had the following implementation for creating a password reset token:

// old
import { generateId } from "lucia";
import { sha256 } from "oslo/crypto";
import { encodeHex } from "oslo/encoding";

...

const tokenId = generateId(40);
const tokenHash = encodeHex(
  await sha256(new TextEncoder().encode(tokenId))
);

If I only want to use Oslo, would this translate to the following?

// new
import { sha256 } from "@oslojs/crypto/sha2";
import {
  encodeBase32LowerCaseNoPadding,
  encodeHexLowerCase,
} from "@oslojs/encoding";

const generateRandomToken = () => {
  const bytes = new Uint8Array(20);
  crypto.getRandomValues(bytes);
  return encodeBase32LowerCaseNoPadding(bytes);
};

const tokenId = generateRandomToken();
const tokenHash = encodeHex(
  sha256(new TextEncoder().encode(tokenId))
);

Perhaps I should also replace encodeHex with encodeHexLowerCase as it is shown for the session token in the new Lucia docs, correct?

And then I would store the token in my DB for later usage (as before) and generate the passwordResetLink with the tokenId (as before):

// new
await prisma.passwordResetToken.create({
  data: {
    tokenHash,
    userId,
    // expiresAt: createDate(new TimeSpan(2, "h")), old
    expiresAt: new Date(Date.now() + 2 * 60 * 60 * 1000),
  },
});

const pageUrl = getBaseUrl() + passwordResetPath();
const passwordResetLink = pageUrl + `/${tokenId}`;

Would this be correct?