import base64
import hashlib

from cryptography.fernet import Fernet, InvalidToken

from config import settings


def _build_fernet() -> Fernet:
    raw_key = settings.ENCRYPTION_KEY.encode("utf-8")
    digest = hashlib.sha256(raw_key).digest()
    return Fernet(base64.urlsafe_b64encode(digest))


def encrypt_text(value: str) -> str:
    if not value:
        return ""
    return _build_fernet().encrypt(value.encode("utf-8")).decode("utf-8")


def decrypt_text(value: str) -> str:
    if not value:
        return ""
    try:
        return _build_fernet().decrypt(value.encode("utf-8")).decode("utf-8")
    except InvalidToken:
        return ""


def mask_secret(value: str) -> str:
    if not value:
        return ""
    if len(value) <= 7:
        return "*" * len(value)
    return f"{value[:3]}****{value[-4:]}"