"""Encryption service for VoIdea.

Uses Fernet (symmetric AES-128-CBC with HMAC-SHA256).
Key loaded from ENCRYPTION_KEY env var (must be 32 url-safe base64 bytes).
"""

import base64
import os

from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC

from app.core.config import get_settings


def _derive_key(secret: str, salt: bytes | None = None) -> tuple[bytes, bytes]:
    """Derive a Fernet-compatible key from a secret string.

    Args:
        secret: Raw secret string (any length)
        salt: Optional salt bytes (generated if None)

    Returns:
        Tuple of (key, salt) where key is 32 url-safe base64 bytes
    """
    if salt is None:
        salt = os.urandom(16)
    kdf = PBKDF2HMAC(algorithm=hashes.SHA256(), length=32, salt=salt, iterations=600_000)
    key = base64.urlsafe_b64encode(kdf.derive(secret.encode()))
    return key, salt


def get_fernet() -> Fernet | None:
    """Get Fernet instance from ENCRYPTION_KEY or generate ephemeral.

    Returns:
        Fernet instance or None if no key configured
    """
    settings = get_settings()
    if not settings.encryption_key:
        return None
    key, _ = _derive_key(settings.encryption_key)
    return Fernet(key)


def encrypt(text: str) -> str | None:
    """Encrypt a string.

    Args:
        text: Plain text to encrypt

    Returns:
        Encrypted text (base64 string) or None if encryption not configured
    """
    f = get_fernet()
    if f is None:
        return None
    return f.encrypt(text.encode()).decode()


def decrypt(token: str) -> str | None:
    """Decrypt a string.

    Args:
        token: Encrypted text (base64 string)

    Returns:
        Decrypted plain text or None if decryption fails
    """
    f = get_fernet()
    if f is None:
        return None
    try:
        return f.decrypt(token.encode()).decode()
    except Exception:
        return None