-module(glm_encrypted_file@openssl).
-compile([no_auto_import, nowarn_unused_vars, nowarn_unused_function, nowarn_nomatch, inline]).
-define(FILEPATH, "src/glm_encrypted_file/openssl.gleam").
-export([decrypt/2, encrypt/3]).
-export_type([open_ssl_error/0]).

-if(?OTP_RELEASE >= 27).
-define(MODULEDOC(Str), -moduledoc(Str)).
-define(DOC(Str), -doc(Str)).
-else.
-define(MODULEDOC(Str), -compile([])).
-define(DOC(Str), -compile([])).
-endif.

-type open_ssl_error() :: {open_ssl_error, integer(), binary()}.

-file("src/glm_encrypted_file/openssl.gleam", 41).
?DOC(" Decrypt an encrypted file to a plaintext string\n").
-spec decrypt(binary(), binary()) -> {ok, binary()} | {error, open_ssl_error()}.
decrypt(Encrypted_file, Password_file) ->
    Command_arguments = begin
        _pipe = [[<<"enc"/utf8>>,
                <<"-base64"/utf8>>,
                <<"-aes-256-cbc"/utf8>>,
                <<"-md"/utf8>>,
                <<"sha512"/utf8>>,
                <<"-pbkdf2"/utf8>>,
                <<"-iter"/utf8>>,
                <<"1000000"/utf8>>],
            [<<"-d"/utf8>>],
            [<<"-in"/utf8>>,
                Encrypted_file,
                <<"-pass"/utf8>>,
                <<"file:"/utf8, Password_file/binary>>]],
        lists:append(_pipe)
    end,
    _pipe@1 = shellout:command(
        <<"openssl"/utf8>>,
        Command_arguments,
        <<"."/utf8>>,
        []
    ),
    gleam@result:map_error(
        _pipe@1,
        fun(E) ->
            {Os_error_int, Os_error_string} = E,
            {open_ssl_error, Os_error_int, Os_error_string}
        end
    ).

-file("src/glm_encrypted_file/openssl.gleam", 73).
?DOC(
    " Encrypt a plaintext string to an encrypted file\n"
    "\n"
    " See README for details, but in short: you must ensure that both the\n"
    " plaintext file and the password file are secure. Delete the plaintext file\n"
    " once the encrypted file has been created from it.\n"
    "\n"
    " TODO: investigate sending plaintext over stdin to openssl shellout process\n"
    " TODO: see https://github.com/tynanbe/shellout/issues/4\n"
).
-spec encrypt(binary(), binary(), binary()) -> {ok, nil} |
    {error, open_ssl_error()}.
encrypt(Plaintext_file, Encrypted_file, Password_file) ->
    Command_arguments = begin
        _pipe = [[<<"enc"/utf8>>,
                <<"-base64"/utf8>>,
                <<"-aes-256-cbc"/utf8>>,
                <<"-md"/utf8>>,
                <<"sha512"/utf8>>,
                <<"-pbkdf2"/utf8>>,
                <<"-iter"/utf8>>,
                <<"1000000"/utf8>>],
            [<<"-e"/utf8>>, <<"-salt"/utf8>>],
            [<<"-in"/utf8>>,
                Plaintext_file,
                <<"-out"/utf8>>,
                Encrypted_file,
                <<"-pass"/utf8>>,
                <<"file:"/utf8, Password_file/binary>>]],
        lists:append(_pipe)
    end,
    _pipe@1 = shellout:command(
        <<"openssl"/utf8>>,
        Command_arguments,
        <<"."/utf8>>,
        []
    ),
    _pipe@2 = gleam@result:map(_pipe@1, fun(_) -> nil end),
    gleam@result:map_error(
        _pipe@2,
        fun(E) ->
            {Os_error_int, Os_error_string} = E,
            {open_ssl_error, Os_error_int, Os_error_string}
        end
    ).