from cryptography.fernet import Fernet

from app.config import settings


def encrypt_xprv(xprv_base58: str) -> bytes:
    return Fernet(settings.xprv_encryption_key).encrypt(xprv_base58.encode())


def decrypt_xprv(token: bytes) -> str:
    return Fernet(settings.xprv_encryption_key).decrypt(token).decode()


def encrypt_round_seed(server_seed_hex: str) -> str:
    """B-73 (DAT-64, SEC-56): a round's secret encrypted at rest with the same key that
    protects the master xprv, so a copy of the database alone never reveals it. The Fernet
    token is ASCII, stored as text."""
    return Fernet(settings.xprv_encryption_key).encrypt(server_seed_hex.encode()).decode()


def decrypt_round_seed(token: str) -> str:
    return Fernet(settings.xprv_encryption_key).decrypt(token.encode()).decode()