"""Fernet symmetric encryption for field-level encryption at rest.

Currently used for a single field: bank_details.account_number_encrypted
(src/apps/settings/models/bank_details.py). Key is read from
settings.BANK_DETAILS_ENCRYPTION_KEY — see .env.example for how to generate
one. Do not reuse this module for anything requiring key rotation support;
none exists yet (matches this codebase's current JWT_SECRET posture).
"""
from cryptography.fernet import Fernet, InvalidToken  # noqa: F401  (re-exported for callers)

from src.core.config import settings


def _fernet() -> Fernet:
    if not settings.BANK_DETAILS_ENCRYPTION_KEY:
        raise RuntimeError("BANK_DETAILS_ENCRYPTION_KEY is not configured")
    return Fernet(settings.BANK_DETAILS_ENCRYPTION_KEY.encode())


def encrypt_value(plaintext: str) -> str:
    return _fernet().encrypt(plaintext.encode()).decode()


def decrypt_value(token: str) -> str:
    return _fernet().decrypt(token.encode()).decode()