import os
from cryptography.fernet import Fernet, InvalidToken

_KEY_NAME = "BESTWEB_SECRET_KEY"

def _fernet() -> Fernet:
    key = os.getenv(_KEY_NAME)
    if not key:
        raise RuntimeError(f"{_KEY_NAME} belum diset")
    return Fernet(key.encode())

def encrypt_secret(value: str) -> str:
    return _fernet().encrypt(value.encode()).decode()

def decrypt_secret(value: str) -> str:
    try:
        return _fernet().decrypt(value.encode()).decode()
    except (InvalidToken, ValueError):
        # Legacy plaintext values can be migrated once on save.
        return value