from __future__ import annotations

from govoplan_core.core.encryption import (
    ContentProtectionRequest,
    ContentUnprotectionRequest,
    ProtectedContent,
    encryption_content_cipher,
)
from govoplan_files.backend.runtime import get_registry
from govoplan_files.backend.storage.common import FileStorageError


FILES_PROTECTION_PROFILE = "files-server-envelope-v1"


def protect_blob_content(
    session: object,
    *,
    tenant_id: str,
    blob_id: str,
    vault_id: str,
    ciphertext_ref: str,
    plaintext: bytes,
    actor_id: str,
    content_type: str | None,
) -> ProtectedContent:
    capability = encryption_content_cipher(get_registry())
    if capability is None:
        raise FileStorageError(
            "File encryption was requested, but the Encryption module is unavailable."
        )
    try:
        return capability.protect_content(
            session,
            request=ContentProtectionRequest(
                tenant_id=tenant_id,
                owner_module="files",
                resource_type="file_blob",
                resource_id=blob_id,
                profile_id=FILES_PROTECTION_PROFILE,
                vault_id=vault_id,
                ciphertext_ref=ciphertext_ref,
                plaintext=plaintext,
                policy_decision_ref="files:explicit-vault-selection:v1",
                idempotency_key=f"file-blob:{blob_id}:content:v1",
                actor_id=actor_id,
                metadata={
                    "content_type": content_type or "application/octet-stream",
                },
            ),
        )
    except Exception as exc:
        raise FileStorageError(
            "Managed file content could not be protected by the configured vault."
        ) from exc


def unprotect_blob_content(
    session: object,
    *,
    tenant_id: str,
    blob_id: str,
    envelope_id: str,
    ciphertext: bytes,
) -> bytes:
    capability = encryption_content_cipher(get_registry())
    if capability is None:
        raise FileStorageError(
            "This file is encrypted and cannot be read while Encryption is unavailable."
        )
    try:
        return capability.unprotect_content(
            session,
            request=ContentUnprotectionRequest(
                tenant_id=tenant_id,
                owner_module="files",
                resource_type="file_blob",
                resource_id=blob_id,
                envelope_id=envelope_id,
                ciphertext=ciphertext,
            ),
        )
    except Exception as exc:
        raise FileStorageError(
            "Managed file content could not be opened with its protection envelope."
        ) from exc


__all__ = [
    "FILES_PROTECTION_PROFILE",
    "protect_blob_content",
    "unprotect_blob_content",
]