package authcenter

import (
	"context"
	"sync"

	"github.com/tidbcloud/tiinf/errs"

	"github.com/tidbcloud/account/commons/config"
	"github.com/tidbcloud/pkgv2/secret/encrypt"
	"github.com/tidbcloud/pkgv2/secret/provider"
)

var (
	onceKmsEnc        encrypt.Encryptor
	onceKmsEncInit    sync.Once
	onceKmsEncInitErr error
)

func GetKmsEncryptor(_ context.Context) (encrypt.Encryptor, error) {
	onceKmsEncInit.Do(func() {
		cmkArn := getCmkArn()
		onceKmsEnc, onceKmsEncInitErr = provider.NewSecretEncryptor(cmkArn)
	})
	return onceKmsEnc, onceKmsEncInitErr
}

func getCmkArn() string {
	var cmkArn string
	if config.IsProdEnv() {
		cmkArn = "arn:aws:kms:us-west-2:380838443567:key/6a3f87f3-d032-414b-870f-458979546c97"
	} else {
		cmkArn = "arn:aws:kms:us-west-2:385595570414:key/f15101b5-6aed-48bf-9b9a-fc36406efe92"
	}
	return cmkArn
}

func DecryptCredential(ctx context.Context, encryptCredential string) (string, error) {
	kmsEnc, err := GetKmsEncryptor(ctx)
	if err != nil {
		return "", errs.NewInternalUnknown("GetKmsEncryptor error", err)
	}
	decryptBase64, err := encrypt.DecryptBase64(kmsEnc, encryptCredential)
	if err != nil {
		return "", errs.NewInternalUnknown("EncryptBase64 rawCredential error", err)
	}
	//tilog.Info(ctx, "DecryptCredential", zap.Any("encryptCredential", encryptCredential), zap.Any("decryptBase64", decryptBase64))
	return decryptBase64.String(), nil
}

func EncryptCredential(ctx context.Context, rawCredential string) (string, error) {
	kmsEnc, err := GetKmsEncryptor(ctx)
	if err != nil {
		return "", errs.NewInternalUnknown("GetKmsEncryptor error", err)
	}
	encryptBase64, err := encrypt.EncryptBase64(kmsEnc, encrypt.Secret(rawCredential))
	if err != nil {
		return "", errs.NewInternalUnknown("EncryptBase64 rawCredential error", err)
	}
	//tilog.Info(ctx, "EncryptCredential", zap.Any("rawCredential", rawCredential), zap.Any("encryptBase64", encryptBase64))
	return encryptBase64, nil
}