"""PGP encryption/decryption for the Mail plugin using pgpy.

Extracted from services.py as part of the God-object split (BUG-018 pilot).
Re-exported by ``app.plugins.builtins.mail.services``.
"""

from __future__ import annotations

import pgpy


def import_pgp_private_key(private_key_armored: str, passphrase: str = "") -> tuple[str, str]:
    """Import a PGP private key. Returns (key_id, public_key_armored)."""
    key, _ = pgpy.PGPKey.from_blob(private_key_armored)
    if key.is_protected:
        with key.unlock(passphrase):
            pub_key = key.pubkey
            key_id = str(key.fingerprint).upper()[-16:]
            return key_id, str(pub_key)
    pub_key = key.pubkey
    key_id = str(key.fingerprint).upper()[-16:]
    return key_id, str(pub_key)


def import_pgp_public_key(public_key_armored: str) -> str:
    """Import a PGP public key. Returns key_id."""
    key, _ = pgpy.PGPKey.from_blob(public_key_armored)
    return str(key.fingerprint).upper()[-16:]


def pgp_encrypt_message(plaintext: str, recipient_public_key_armored: str) -> str:
    """Encrypt a message with recipient's public PGP key."""
    pub_key, _ = pgpy.PGPKey.from_blob(recipient_public_key_armored)
    msg = pgpy.PGPMessage.new(plaintext)
    encrypted = pub_key.encrypt(msg)
    return str(encrypted)


def pgp_decrypt_message(ciphertext: str, private_key_armored: str, passphrase: str = "") -> str:
    """Decrypt a PGP-encrypted message."""
    key, _ = pgpy.PGPKey.from_blob(private_key_armored)
    enc_msg = pgpy.PGPMessage.from_blob(ciphertext)
    if key.is_protected:
        with key.unlock(passphrase):
            decrypted = key.decrypt(enc_msg)
            return decrypted.message.decode("utf-8")
    decrypted = key.decrypt(enc_msg)
    return decrypted.message.decode("utf-8")