"""Symmetric encryption for secrets that must be stored (not just hashed,
like a login password) because the app needs the plaintext back later — so
far, only Workspace.db_password_encrypted (app/models/workspace.py). Uses
Fernet (AES-128-CBC + HMAC, from the `cryptography` package already present
transitively via python-jose[cryptography]) keyed by settings.
workspace_encryption_key, a single app-wide key rather than a per-record one
since there is exactly one thing being encrypted today."""

from cryptography.fernet import Fernet

from app.core.config import settings

_fernet = Fernet(settings.workspace_encryption_key.encode())


def encrypt_secret(plaintext: str) -> str:
    return _fernet.encrypt(plaintext.encode()).decode()


def decrypt_secret(ciphertext: str) -> str:
    return _fernet.decrypt(ciphertext.encode()).decode()