using DigitalData.EmailProfiler.Application.Common.Interfaces;
using Microsoft.AspNetCore.DataProtection;

namespace DigitalData.EmailProfiler.Infrastructure.Services;

/// <summary>
/// Encryption service using ASP.NET Core Data Protection API.
/// Passwords are encrypted at rest in the database.
/// </summary>
public class DataProtectionEncryptionService(IDataProtectionProvider Provider) : IEncryptionService
{
    private readonly IDataProtector Protector = Provider.CreateProtector("EmailProfiler.Passwords");

    public string Encrypt(string plainText)
    {
        if (string.IsNullOrEmpty(plainText))
            return string.Empty;

        return Protector.Protect(plainText);
    }

    public string Decrypt(string cipherText)
    {
        if (string.IsNullOrEmpty(cipherText))
            return string.Empty;

        try
        {
            return Protector.Unprotect(cipherText);
        }
        catch (Exception)
        {
            // If decryption fails, return empty (corrupt data or wrong key)
            return string.Empty;
        }
    }
}