import { env } from "cloudflare:workers";
import { decryptSecret, encryptSecret } from "./crypto";
import { badRequest } from "./errors";

/** CI secrets (owner, repo and environment scopes) share one HKDF-derived key, distinct from TOTP seeds (AUTH-A10). */
const REPO_SECRET_CONTEXT = { purpose: "repo-secret" };

export async function encryptRepoSecret(value: string): Promise<{ ciphertext: string; iv: string }> {
  if (!env.SECRETS_KEY) throw badRequest("SECRETS_KEY is not configured on this instance");
  return encryptSecret(env.SECRETS_KEY, value, REPO_SECRET_CONTEXT);
}

export async function decryptRepoSecret(ciphertext: string, iv: string): Promise<string> {
  if (!env.SECRETS_KEY) throw badRequest("SECRETS_KEY is not configured on this instance");
  return decryptSecret(env.SECRETS_KEY, ciphertext, iv, REPO_SECRET_CONTEXT);
}