<?php
/**
 * AES-256-CBC encryption helper.
 *
 * Encrypts and decrypts sensitive data (API keys) using WordPress
 * authentication salts as the key derivation source.
 *
 * @package AICommerce\Core
 */

declare(strict_types=1);

namespace AICommerce\Core;

/**
 * Handles encryption and decryption of sensitive values.
 */
class Encryption {

	/**
	 * Derived encryption key.
	 *
	 * @var string
	 */
	private string $key;

	/**
	 * Constructor.
	 *
	 * Derives the encryption key from WordPress auth salts.
	 */
	public function __construct() {
		$auth_key   = defined( 'AUTH_KEY' ) ? AUTH_KEY : 'aicommerce-fallback-key';
		$secure_key = defined( 'SECURE_AUTH_KEY' ) ? SECURE_AUTH_KEY : 'aicommerce-fallback-secure';
		$this->key  = hash( 'sha256', $auth_key . $secure_key, true );
	}

	/**
	 * Encrypt a plaintext string.
	 *
	 * @param string $plaintext The value to encrypt.
	 *
	 * @return string Base64-encoded IV + ciphertext.
	 */
	public function encrypt( string $plaintext ): string {
		$iv         = random_bytes( 16 );
		$ciphertext = openssl_encrypt( $plaintext, 'AES-256-CBC', $this->key, OPENSSL_RAW_DATA, $iv );

		if ( false === $ciphertext ) {
			return '';
		}

		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode
		return base64_encode( $iv . $ciphertext );
	}

	/**
	 * Decrypt a ciphertext string.
	 *
	 * @param string $ciphertext Base64-encoded IV + ciphertext.
	 *
	 * @return string Decrypted plaintext, or empty string on failure.
	 */
	public function decrypt( string $ciphertext ): string {
		if ( empty( $ciphertext ) ) {
			return '';
		}

		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode
		$data = base64_decode( $ciphertext, true );

		if ( false === $data || strlen( $data ) < 17 ) {
			return '';
		}

		$iv        = substr( $data, 0, 16 );
		$encrypted = substr( $data, 16 );
		$decrypted = openssl_decrypt( $encrypted, 'AES-256-CBC', $this->key, OPENSSL_RAW_DATA, $iv );

		return is_string( $decrypted ) ? $decrypted : '';
	}
}