"""店铺凭证 AES-GCM 加解密（shops/categories/publish 冻结链路使用）。

鉴权（JWT/APP_TOKEN）已按 V2.1 决策移除，后续加账户体系时再引入。
"""
from __future__ import annotations

import base64
import hashlib
import os

from config import get_settings


def _derive_key() -> bytes:
    settings = get_settings()
    return hashlib.sha256(settings.secret_key.encode("utf-8")).digest()


def encrypt_secret(plaintext: str) -> str:
    """AES-GCM 加密，返回 base64(nonce + ciphertext + tag)。"""
    from cryptography.hazmat.primitives.ciphers.aead import AESGCM

    key = _derive_key()
    nonce = os.urandom(12)
    aesgcm = AESGCM(key)
    ct = aesgcm.encrypt(nonce, plaintext.encode("utf-8"), None)
    return base64.b64encode(nonce + ct).decode("ascii")


def decrypt_secret(ciphertext: str) -> str:
    from cryptography.hazmat.primitives.ciphers.aead import AESGCM

    key = _derive_key()
    raw = base64.b64decode(ciphertext.encode("ascii"))
    nonce, ct = raw[:12], raw[12:]
    aesgcm = AESGCM(key)
    return aesgcm.decrypt(nonce, ct, None).decode("utf-8")