using Microsoft.AspNetCore.DataProtection;
using Microsoft.EntityFrameworkCore.Storage.ValueConversion;

namespace ZB.MOM.WW.ScadaBridge.ConfigurationDatabase;

/// <summary>Versioned protection of complete protocol JSON, including nested credentials.</summary>
public sealed class DataConnectionSecretConverter(IDataProtector protector) : ValueConverter<string?, string?>(
    value => value == null ? null : Protect(protector, value),
    value => value == null ? null : Unprotect(protector, value))
{
    internal const string Prefix = "dp:protocol:v1:";
    internal const string Purpose = EncryptedStringConverter.ProtectorPurpose + ".DataConnection";
    /// <summary>Encrypts plaintext protocol JSON and tags it with the versioned prefix.</summary>
    /// <param name="protector">The data protector to encrypt with.</param>
    /// <param name="plaintext">The plaintext to protect.</param>
    /// <returns>The prefixed protected string.</returns>
    internal static string Protect(IDataProtector protector, string plaintext) => Prefix + protector.Protect(plaintext);
    /// <summary>Decrypts a stored, versioned protected value.</summary>
    /// <param name="protector">The data protector to decrypt with.</param>
    /// <param name="stored">The stored value, which must carry the versioned prefix.</param>
    /// <returns>The decrypted plaintext.</returns>
    internal static string Unprotect(IDataProtector protector, string stored)
        => stored.StartsWith(Prefix, StringComparison.Ordinal)
            ? protector.Unprotect(stored[Prefix.Length..])
            : throw new InvalidOperationException("Protocol configuration requires the startup encryption upgrade before it can be read.");
}