import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto'

const ALG = 'aes-256-gcm'
const IV_LEN = 12
const TAG_LEN = 16

function key() {
  const s = process.env.SETTINGS_SECRET
  if (!s) throw new Error('SETTINGS_SECRET env var not set')
  return scryptSync(s, 'hnf-settings-v1', 32)
}

export function encrypt(plaintext) {
  const iv = randomBytes(IV_LEN)
  const c = createCipheriv(ALG, key(), iv)
  const enc = Buffer.concat([c.update(plaintext, 'utf8'), c.final()])
  return Buffer.concat([iv, c.getAuthTag(), enc]).toString('base64')
}

export function decrypt(b64) {
  const buf = Buffer.from(b64, 'base64')
  const iv = buf.subarray(0, IV_LEN)
  const tag = buf.subarray(IV_LEN, IV_LEN + TAG_LEN)
  const enc = buf.subarray(IV_LEN + TAG_LEN)
  const d = createDecipheriv(ALG, key(), iv)
  d.setAuthTag(tag)
  return Buffer.concat([d.update(enc), d.final()]).toString('utf8')
}