package facade_imp

import (
	"github.com/pingcap/errors"
	"github.com/tidbcloud/pkgv2/secret/encrypt"
	"github.com/tidbcloud/pkgv2/secret/provider"
	"github.com/tidbcloud/serverless-service/internal/config"
	"github.com/tidbcloud/serverless-service/internal/domain/facade"
)

type encryptorFacade struct {
	enc encrypt.Encryptor
}

func NewEncryptorFacade() facade.EncryptorFacade {
	cmkArn := config.Global().SvcAddrConfig.CMKArn
	enc, err := provider.NewSecretEncryptor(cmkArn)
	if err != nil {
		panic("initialize encryptor failed")
	}
	return &encryptorFacade{
		enc: enc,
	}
}

func (e *encryptorFacade) EncryptBase64(text string) (string, error) {
	secretTxt, err := encrypt.EncryptBase64(e.enc, encrypt.Secret(text))
	if err != nil {
		return "", errors.Annotate(err, "encrypt failed")
	}
	return secretTxt, nil
}

func (e *encryptorFacade) DecryptBase64(encryptedEncoded string) (string, error) {
	plainText, err := encrypt.DecryptBase64(e.enc, encryptedEncoded)
	if err != nil {
		return "", errors.Annotate(err, "decrypt failed")
	}
	return string(plainText), nil
}