"""Encrypt/decrypt LLM API keys at rest (Fernet).

The key comes from settings.LLM_ENCRYPTION_KEY (set in .env). If it's missing,
we derive a stable key from SECRET_KEY so dev still works — but for production
you should set a dedicated LLM_ENCRYPTION_KEY.
"""
import base64
import hashlib

from django.conf import settings
from cryptography.fernet import Fernet, InvalidToken

_PREFIX = "enc::"


def _fernet() -> Fernet:
    key = getattr(settings, "LLM_ENCRYPTION_KEY", "") or ""
    if key:
        return Fernet(key.encode() if isinstance(key, str) else key)
    # Fallback: derive a 32-byte urlsafe key from SECRET_KEY (dev convenience).
    digest = hashlib.sha256(settings.SECRET_KEY.encode()).digest()
    return Fernet(base64.urlsafe_b64encode(digest))


def encrypt_key(plaintext: str) -> str:
    if not plaintext:
        return ""
    token = _fernet().encrypt(plaintext.encode()).decode()
    return _PREFIX + token


def decrypt_key(stored: str) -> str:
    if not stored:
        return ""
    if not stored.startswith(_PREFIX):
        return stored  # legacy/plain value
    try:
        return _fernet().decrypt(stored[len(_PREFIX):].encode()).decode()
    except InvalidToken:
        return ""


def mask_key(plaintext: str) -> str:
    """Return a display-safe masked form: sk-…d2cc"""
    if not plaintext:
        return ""
    if len(plaintext) <= 8:
        return "••••"
    return f"{plaintext[:3]}…{plaintext[-4:]}"