<?php
namespace EveAI\Chat;

class Security {
    private static $encryption_method = 'aes-256-cbc';

    public static function encrypt_api_key(string $key): string {
        if (empty($key)) return '';

        $salt = wp_salt('auth');
        $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length(self::$encryption_method));

        $encrypted = openssl_encrypt(
            $key,
            self::$encryption_method,
            $salt,
            0,
            $iv
        );

        return base64_encode($iv . $encrypted);
    }

    public static function decrypt_api_key(string $encrypted): string {
        if (empty($encrypted)) return '';

        $salt = wp_salt('auth');
        $data = base64_decode($encrypted);

        $iv_length = openssl_cipher_iv_length(self::$encryption_method);
        $iv = substr($data, 0, $iv_length);
        $encrypted_data = substr($data, $iv_length);

        return openssl_decrypt(
            $encrypted_data,
            self::$encryption_method,
            $salt,
            0,
            $iv
        );
    }

    public static function generate_nonce(): string {
        return wp_create_nonce('eveai_chat_nonce');
    }

    public static function verify_nonce(string $nonce): bool {
        return wp_verify_nonce($nonce, 'eveai_chat_nonce');
    }
}
