from cryptography.fernet import Fernet
import os

class FieldEncryptor:
    def __init__(self):
        key = os.environ.get("ENCRYPTION_KEY")
        if not key:
            raise ValueError("ENCRYPTION_KEY environment variable is missing. Application cannot start without it.")
        self.fernet = Fernet(key.encode())
    
    def encrypt(self, value: str) -> str:
        if not value:
            return value
        return self.fernet.encrypt(str(value).encode()).decode()
    
    def decrypt(self, token: str) -> str:
        if not token:
            return token
        try:
            return self.fernet.decrypt(token.encode()).decode()
        except:
            return token  # Return as-is if decryption fails
    
    def mask(self, value: str, visible: int = 4) -> str:
        """Return masked version for display/logs."""
        if not value or len(value) <= visible:
            return "****"
        return value[:visible] + "*" * (len(value) - visible)

encryptor = FieldEncryptor()