using Microsoft.AspNetCore.DataProtection;

namespace w4c_workflows.Services.Credentials;

/// <summary>
/// Encrypts credential payloads with ASP.NET Core Data Protection (AES-based,
/// authenticated). Key management/rotation is delegated to the Data Protection
/// keyring; the purpose string pins the format so keys can be rotated later.
/// </summary>
public sealed class DataProtectionCredentialCipher : ICredentialCipher
{
    private const string Purpose = "w4c.workflows.credentials.v1";

    private readonly IDataProtector _protector;

    public DataProtectionCredentialCipher(IDataProtectionProvider provider)
    {
        _protector = provider.CreateProtector(Purpose);
    }

    public string Protect(string plaintext) => _protector.Protect(plaintext);

    public string Unprotect(string ciphertext) => _protector.Unprotect(ciphertext);
}