"""Encrypted storage primitives for device-management credentials."""
import os
from cryptography.fernet import Fernet, InvalidToken


class CredentialKeyMissingError(RuntimeError):
    pass


class CredentialDecryptionError(RuntimeError):
    pass


def _fernet() -> Fernet:
    key = os.getenv("DEVICE_CREDENTIAL_KEY", "").strip()
    if not key:
        raise CredentialKeyMissingError("DEVICE_CREDENTIAL_KEY belum dikonfigurasi.")
    try:
        return Fernet(key.encode("ascii"))
    except (ValueError, TypeError) as exc:
        raise CredentialKeyMissingError("DEVICE_CREDENTIAL_KEY tidak valid.") from exc


def encrypt_secret(value: str) -> str:
    if not value:
        raise ValueError("Secret credential wajib diisi.")
    return _fernet().encrypt(value.encode("utf-8")).decode("ascii")


def decrypt_secret(value: str) -> str:
    keys = []
    for k_name in ("DEVICE_CREDENTIAL_KEY", "BESTWEB_SECRET_KEY"):
        k = os.getenv(k_name, "").strip()
        if k:
            try:
                keys.append(Fernet(k.encode("ascii")))
            except Exception:
                pass
    for f in keys:
        try:
            return f.decrypt(value.encode("ascii")).decode("utf-8")
        except InvalidToken:
            continue
    raise CredentialDecryptionError("Credential tidak dapat didekripsi.")