"""Encrypted storage primitives for device-management credentials."""
import os
from cryptography.fernet import Fernet, InvalidToken


class CredentialKeyMissingError(RuntimeError):
    pass


class CredentialDecryptionError(RuntimeError):
    pass


def _fernet() -> Fernet:
    key = os.getenv("DEVICE_CREDENTIAL_KEY", "").strip()
    if not key:
        raise CredentialKeyMissingError("DEVICE_CREDENTIAL_KEY belum dikonfigurasi.")
    try:
        return Fernet(key.encode("ascii"))
    except (ValueError, TypeError) as exc:
        raise CredentialKeyMissingError("DEVICE_CREDENTIAL_KEY tidak valid.") from exc


def encrypt_secret(value: str) -> str:
    if not value:
        raise ValueError("Secret credential wajib diisi.")
    return _fernet().encrypt(value.encode("utf-8")).decode("ascii")


def decrypt_secret(value: str) -> str:
    try:
        return _fernet().decrypt(value.encode("ascii")).decode("utf-8")
    except InvalidToken as exc:
        raise CredentialDecryptionError("Credential tidak dapat didekripsi.") from exc