require "openssl"

module InstaplusEncryptor
  module Encryptor
    class OpenSSL
      class << self
        def default_cipher
          "aes-256-cbc"
        end
      end

      def initialize(secret, **options)
        @secret = secret
        @cipher = options[:cipher] || self.class.default_cipher
      end

      def encrypt_and_sign(value)
        _encrypt(value)
      end

      def decrypt_and_verify(data)
        _decrypt(data)
      end

      private

      def _encrypt(value)
        cipher = new_cipher
        cipher.encrypt
        cipher.key = @secret

        # Rely on OpenSSL for the initialization vector
        iv = cipher.random_iv

        encrypted_data = cipher.update(value)
        encrypted_data << cipher.final

        blob = "#{::Base64.strict_encode64(encrypted_data)}--#{::Base64.strict_encode64(iv)}"
        Base64.strict_encode64(blob)
      end

      def _decrypt(encrypted_message)
        cipher = new_cipher
        blob = Base64.strict_decode64(encrypted_message)
        encrypted_data, iv = blob.split("--".freeze).map { |v| ::Base64.strict_decode64(v) }

        cipher.decrypt
        cipher.key = @secret
        cipher.iv  = iv

        decrypted_data = cipher.update(encrypted_data)
        decrypted_data << cipher.final
        decrypted_data
      end

      def new_cipher
        ::OpenSSL::Cipher.new(@cipher)
      end
    end
  end
end