"""Fernet symmetric encryption utilities for credential payloads."""

from __future__ import annotations

from cryptography.fernet import Fernet, InvalidToken  # noqa: F401 — re-exported for callers


def make_fernet(key: str) -> Fernet:
    """Return a Fernet instance from a base64-encoded key string."""
    return Fernet(key.encode() if isinstance(key, str) else key)


def encrypt_payload(key: str, plaintext: str) -> str:
    """Encrypt *plaintext* and return the base64 ciphertext string."""
    f = make_fernet(key)
    return f.encrypt(plaintext.encode()).decode()


def decrypt_payload(key: str, ciphertext: str) -> str:
    """Decrypt *ciphertext* and return the plaintext string.

    Raises ``cryptography.fernet.InvalidToken`` if the key is wrong or the
    token is malformed.
    """
    f = make_fernet(key)
    return f.decrypt(ciphertext.encode()).decode()