using System;
using System.Text;
using System.Threading.Tasks;
using VaultSharp;
using VaultSharp.V1.AuthMethods;
using VaultSharp.V1.AuthMethods.Token;
using VaultSharp.V1.Commons;
using VaultSharp.V1.SecretsEngines.Transit;

namespace FrameworkDAL.CustomCode.Vault
{
    public class VaultSharp  // Changed from VaultSharp to VaultService
    {
        private readonly IVaultClient _vaultClient;
        private readonly ITransitSecretsEngine _transitEngine;

        public VaultSharp(string vaultAddress, string vaultToken)
        {
            try
            {
                var authMethod = new TokenAuthMethodInfo(vaultToken);
                var settings = new VaultClientSettings(vaultAddress, authMethod);
                _vaultClient = new VaultClient(settings);
                _transitEngine = _vaultClient.V1.Secrets.Transit;  // Fixed: removed asterisks
            }
            catch (Exception ex)
            {
                throw new Exception($"Failed to initialize Vault Transit service: {ex.Message}", ex);
            }
        }

        public async Task<string> EncryptDataAsync(string keyName, string plaintext)
        {
            // Encode the plaintext to Base64
            string base64Plaintext = Convert.ToBase64String(Encoding.UTF8.GetBytes(plaintext));
            // Create encryption options
            var encryptOptions = new EncryptRequestOptions
            {
                Base64EncodedPlainText = base64Plaintext
            };
            // Encrypt the data
            Secret<EncryptionResponse> encryptionResponse = await _vaultClient.V1.Secrets.Transit.EncryptAsync(keyName, encryptOptions);
            // Retrieve the ciphertext
            string ciphertext = encryptionResponse.Data.CipherText;
            return ciphertext;
        }

        public async Task<string> DecryptDataAsync(string keyName, string ciphertext)
        {
            // Create decryption options
            var decryptOptions = new DecryptRequestOptions
            {
                CipherText = ciphertext
            };
            // Decrypt the data
            Secret<DecryptionResponse> decryptionResponse = await _vaultClient.V1.Secrets.Transit.DecryptAsync(keyName, decryptOptions);
            // Decode the Base64 plaintext
            string base64Plaintext = decryptionResponse.Data.Base64EncodedPlainText;
            string plaintext = Encoding.UTF8.GetString(Convert.FromBase64String(base64Plaintext));
            return plaintext;
        }
    }
}