<?php
namespace App\Helpers;

use RuntimeException;

class EncryptionHelper
{
    private const CIPHER = 'aes-256-gcm';
    private const TAG_LENGTH = 16; // GCM tag length

    public static function secret_encrypt(string $plaintext, string $keyHex): string
    {
        // Convert hex key into raw 32 bytes
        $key = hex2bin($keyHex);
        if ($key === false || strlen($key) !== 32) {
            throw new RuntimeException('Invalid key: must be 64 hex characters (32 bytes)');
        }

        $iv = random_bytes(openssl_cipher_iv_length(self::CIPHER));
        $tag = '';
        $ct = openssl_encrypt(
            $plaintext,
            self::CIPHER,
            $key,
            OPENSSL_RAW_DATA,
            $iv,
            $tag,
            '',
            self::TAG_LENGTH
        );

        if ($ct === false) {
            throw new RuntimeException('Encrypt failed');
        }

        // Pack as iv + tag + ciphertext → base64
        return base64_encode($iv . $tag . $ct);
    }

    public static function secret_decrypt(string $b64, string $keyHex): string
    {
        // Convert hex key into raw 32 bytes
        $key = hex2bin($keyHex);
        if ($key === false || strlen($key) !== 32) {
            throw new RuntimeException('Invalid key: must be 64 hex characters (32 bytes)');
        }

        $raw = base64_decode($b64, true);
        if ($raw === false) {
            throw new RuntimeException('Bad base64');
        }

        $ivlen = openssl_cipher_iv_length(self::CIPHER);
        $iv  = substr($raw, 0, $ivlen);
        $tag = substr($raw, $ivlen, self::TAG_LENGTH);
        $ct  = substr($raw, $ivlen + self::TAG_LENGTH);

        $pt = openssl_decrypt($ct, self::CIPHER, $key, OPENSSL_RAW_DATA, $iv, $tag, '');
        if ($pt === false) {
            throw new RuntimeException('Decrypt failed');
        }

        return $pt;
    }
}