"""Symmetric encryption for secrets at rest (OAuth tokens, partner API keys).

Key is derived from GOGO_SECRET_KEY; rotate by re-encrypting after a key change.
"""

import base64
import hashlib

from cryptography.fernet import Fernet

from gogo.config import get_settings


def _fernet() -> Fernet:
    key = hashlib.sha256(get_settings().secret_key.encode()).digest()
    return Fernet(base64.urlsafe_b64encode(key))


def encrypt(plaintext: str) -> str:
    return _fernet().encrypt(plaintext.encode()).decode()


def decrypt(ciphertext: str) -> str:
    return _fernet().decrypt(ciphertext.encode()).decode()