// Package crypto implements the password-based and DPAPI-based encryption
// layers that the original WinAuth used to protect its config XML, plus a
// modern AES-GCM scheme used by the new YAML/JSON config format.
//
// The legacy reader is provided for one-way migration only — new files are
// always written in the modern format.
package crypto

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/sha1"
	"crypto/sha256"
	"encoding/base64"
	"errors"
	"fmt"

	"golang.org/x/crypto/pbkdf2"
)

const (
	saltLength       = 8
	legacyIterations = 2000
	legacyKeySize    = 32 // 256 bits
)

// EncryptModern encrypts plaintext with a passphrase using PBKDF2-SHA256 +
// AES-256-GCM. The wire format is:
//
//	"WAGO1" || base64( salt(16) || nonce(12) || ciphertext+tag )
//
// All-in-one base64 makes the result safe to embed in YAML/JSON.
func EncryptModern(plaintext, passphrase []byte) (string, error) {
	salt := make([]byte, 16)
	if _, err := rand.Read(salt); err != nil {
		return "", err
	}
	key := pbkdf2.Key(passphrase, salt, 100_000, 32, sha256.New)

	block, err := aes.NewCipher(key)
	if err != nil {
		return "", err
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return "", err
	}
	nonce := make([]byte, gcm.NonceSize())
	if _, err := rand.Read(nonce); err != nil {
		return "", err
	}
	ct := gcm.Seal(nil, nonce, plaintext, nil)

	buf := make([]byte, 0, len(salt)+len(nonce)+len(ct))
	buf = append(buf, salt...)
	buf = append(buf, nonce...)
	buf = append(buf, ct...)
	return "WAGO1" + base64.StdEncoding.EncodeToString(buf), nil
}

// DecryptModern is the inverse of EncryptModern.
func DecryptModern(encoded string, passphrase []byte) ([]byte, error) {
	const prefix = "WAGO1"
	if len(encoded) < len(prefix) || encoded[:len(prefix)] != prefix {
		return nil, errors.New("crypto: not a WAGO1 payload")
	}
	raw, err := base64.StdEncoding.DecodeString(encoded[len(prefix):])
	if err != nil {
		return nil, fmt.Errorf("crypto: base64 decode: %w", err)
	}
	if len(raw) < 16+12+16 {
		return nil, errors.New("crypto: payload too short")
	}
	salt, nonce, ct := raw[:16], raw[16:28], raw[28:]

	key := pbkdf2.Key(passphrase, salt, 100_000, 32, sha256.New)
	block, err := aes.NewCipher(key)
	if err != nil {
		return nil, err
	}
	gcm, err := cipher.NewGCM(block)
	if err != nil {
		return nil, err
	}
	pt, err := gcm.Open(nil, nonce, ct, nil)
	if err != nil {
		return nil, fmt.Errorf("crypto: decrypt failed: %w", err)
	}
	return pt, nil
}

// DerivePBKDF2SHA1 reproduces the C# Rfc2898DeriveBytes(password, salt,
// 2000) used by the legacy WinAuth Encrypt/Decrypt sequence. The output
// length matches PBKDF2_KEYSIZE / 8 from the original (32 bytes).
func DerivePBKDF2SHA1(password, salt []byte) []byte {
	return pbkdf2.Key(password, salt, legacyIterations, legacyKeySize, sha1.New)
}