<?php

declare(strict_types=1);

namespace ProCalendarWP\Maps;

final class GeocodingKey
{
    public static function get(): string
    {
        if (defined('PCWP_GEOCODING_API_KEY') && is_string(PCWP_GEOCODING_API_KEY)) {
            return trim(PCWP_GEOCODING_API_KEY);
        }
        $data = get_option('pcwp_geocoding_secret', []);
        if (! is_array($data) || ! isset($data['cipher'], $data['iv'], $data['tag'])) {
            return '';
        }
        $plain = openssl_decrypt(base64_decode($data['cipher'], true) ?: '', 'aes-256-gcm', self::key(), OPENSSL_RAW_DATA, base64_decode($data['iv'], true) ?: '', base64_decode($data['tag'], true) ?: '');
        return is_string($plain) ? $plain : '';
    }

    public static function set(string $value): void
    {
        if ($value === '') {
            delete_option('pcwp_geocoding_secret');
            return;
        }
        $iv = random_bytes(12);
        $tag = '';
        $cipher = openssl_encrypt(trim($value), 'aes-256-gcm', self::key(), OPENSSL_RAW_DATA, $iv, $tag);
        if (! is_string($cipher)) {
            throw new \RuntimeException('Unable to encrypt geocoding credentials.'); // phpcs:ignore WordPress.Security.EscapeOutput.ExceptionNotEscaped -- Exception messages are data; REST encodes them and admin callers escape output.
        }
        update_option('pcwp_geocoding_secret', ['cipher' => base64_encode($cipher), 'iv' => base64_encode($iv), 'tag' => base64_encode($tag)], false);
    }

    private static function key(): string
    {
        return hash_hkdf('sha256', wp_salt('auth'), 32, 'pcwp-geocoding');
    }
}