<?php
/**
 * Ranktim – Encryption helper.
 *
 * Provides AES-256-CBC encrypt / decrypt for the integration key at rest.
 * Falls back to plain base64 when the OpenSSL extension is unavailable.
 *
 * @package Ranktim
 */

if ( ! defined( 'ABSPATH' ) ) {
	exit;
}

class Ranktim_Encryption {

	/** Option key where the per-site derived key is stored. */
	const ENC_KEY_OPTION = 'ranktim_enc_key';

	// -----------------------------------------------------------------------
	// Public API
	// -----------------------------------------------------------------------

	/**
	 * Encrypt a plaintext string.
	 *
	 * @param  string $plaintext
	 * @return string Base64-encoded opaque blob (IV + ciphertext).
	 */
	public function encrypt( string $plaintext ): string {
		if ( ! function_exists( 'openssl_encrypt' ) ) {
			// Very weak fallback — only used when OpenSSL is absent.
			return base64_encode( $plaintext );
		}

		$key    = hex2bin( $this->get_enc_key() );
		$iv     = random_bytes( 16 );
		$cipher = openssl_encrypt( $plaintext, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv );

		return base64_encode( $iv . $cipher );
	}

	/**
	 * Decrypt a blob produced by {@see encrypt()}.
	 *
	 * @param  string $blob
	 * @return string Plaintext, or empty string on failure.
	 */
	public function decrypt( string $blob ): string {
		if ( ! function_exists( 'openssl_decrypt' ) ) {
			return (string) base64_decode( $blob );
		}

		$raw = base64_decode( $blob );

		// Need at least 16-byte IV + 1 byte of cipher data.
		if ( strlen( $raw ) < 17 ) {
			return '';
		}

		$key    = hex2bin( $this->get_enc_key() );
		$iv     = substr( $raw, 0, 16 );
		$cipher = substr( $raw, 16 );
		$plain  = openssl_decrypt( $cipher, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv );

		return $plain !== false ? $plain : '';
	}

	// -----------------------------------------------------------------------
	// Private helpers
	// -----------------------------------------------------------------------

	/**
	 * Return (or lazily create) the 256-bit per-site encryption key,
	 * stored as a 64-char hex string in wp_options.
	 */
	private function get_enc_key(): string {
		$key = get_option( self::ENC_KEY_OPTION );

		if ( ! $key ) {
			$key = bin2hex( random_bytes( 32 ) ); // 64-char hex → 256-bit key
			update_option( self::ENC_KEY_OPTION, $key, false );
		}

		return $key;
	}
}