<?php

namespace Autogedal\TbiBank\Model;

use Magento\Framework\Encryption\EncryptorInterface;
use Magento\Framework\Exception\LocalizedException;

/** Decode stored keys once, preserving legacy plaintext and already processed configuration. */
class KeyValue
{
    public static function decode(string $value, EncryptorInterface $encryptor): string
    {
        // Magento encrypt() writes key-version:cipher-version:payload.
        // Do not attempt decryption of a legacy TBI key or a value already decoded by config metadata.
        if (!preg_match('/^\d+:\d+:/', $value)) {
            return $value;
        }
        try {
            $decoded = $encryptor->decrypt($value);
        } catch (\Throwable $exception) {
            throw new LocalizedException(__('The stored TBI encryption key could not be decrypted.'));
        }
        if ($decoded === '') {
            throw new LocalizedException(__('The stored TBI encryption key could not be decrypted.'));
        }
        return $decoded;
    }
}