"""Token encryption helpers for SocialAccount."""

from cryptography.fernet import Fernet, InvalidToken
from django.conf import settings


def _fernet() -> Fernet:
    key = settings.SOCIAL_TOKEN_ENCRYPTION_KEY
    if not key:
        # Dev-only fallback — generate is not stable across restarts; set the env var.
        key = Fernet.generate_key().decode()
    if isinstance(key, str):
        key = key.encode()
    return Fernet(key)


def encrypt_tokens(plaintext: str) -> str:
    return _fernet().encrypt(plaintext.encode()).decode()


def decrypt_tokens(ciphertext: str) -> str:
    if not ciphertext:
        return ""
    try:
        return _fernet().decrypt(ciphertext.encode()).decode()
    except InvalidToken as exc:
        raise ValueError("Unable to decrypt social tokens") from exc