<?php
namespace App\Services;

class EncryptionService {
    
    protected $key;
    protected $cipher = 'aes-256-cbc';
    
    public function __construct() {
        $this->key = hex2bin(ENCRYPTION_KEY);
    }
    
    /**
     * Encrypt data
     */
    public function encrypt($data) {
        $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length($this->cipher));
        $encrypted = openssl_encrypt($data, $this->cipher, $this->key, 0, $iv);
        return base64_encode($iv . $encrypted);
    }
    
    /**
     * Decrypt data
     */
    public function decrypt($data) {
        $data = base64_decode($data);
        $iv_length = openssl_cipher_iv_length($this->cipher);
        $iv = substr($data, 0, $iv_length);
        $encrypted = substr($data, $iv_length);
        return openssl_decrypt($encrypted, $this->cipher, $this->key, 0, $iv);
    }
    
    /**
     * Encrypt file
     */
    public function encryptFile($sourcePath, $destPath = null) {
        if (!file_exists($sourcePath)) {
            throw new \Exception("Source file not found");
        }
        
        $data = file_get_contents($sourcePath);
        $encrypted = $this->encrypt($data);
        
        if ($destPath === null) {
            $destPath = $sourcePath . '.enc';
        }
        
        file_put_contents($destPath, $encrypted);
        return $destPath;
    }
    
    /**
     * Decrypt file
     */
    public function decryptFile($sourcePath, $destPath = null) {
        if (!file_exists($sourcePath)) {
            throw new \Exception("Source file not found");
        }
        
        $data = file_get_contents($sourcePath);
        $decrypted = $this->decrypt($data);
        
        if ($destPath === null) {
            $destPath = preg_replace('/\.enc$/', '', $sourcePath);
        }
        
        file_put_contents($destPath, $decrypted);
        return $destPath;
    }
    
    /**
     * Hash data (for biometric templates)
     */
    public function hash($data, $algorithm = 'sha256') {
        return hash($algorithm, $data);
    }
    
    /**
     * Generate key pair for digital signatures
     */
    public function generateKeyPair() {
        $config = [
            "digest_alg" => "sha512",
            "private_key_bits" => 2048,
            "private_key_type" => OPENSSL_KEYTYPE_RSA,
        ];
        
        $res = openssl_pkey_new($config);
        
        // Extract private key
        openssl_pkey_export($res, $privateKey);
        
        // Extract public key
        $publicKey = openssl_pkey_get_details($res);
        $publicKey = $publicKey["key"];
        
        return [
            'private' => $privateKey,
            'public' => $publicKey
        ];
    }
    
    /**
     * Sign data
     */
    public function sign($data, $privateKey) {
        openssl_sign($data, $signature, $privateKey, OPENSSL_ALGO_SHA256);
        return base64_encode($signature);
    }
    
    /**
     * Verify signature
     */
    public function verify($data, $signature, $publicKey) {
        $signature = base64_decode($signature);
        return openssl_verify($data, $signature, $publicKey, OPENSSL_ALGO_SHA256);
    }
}