#!/usr/bin/env python3
"""
手机号加解密工具 — 从 ~/.hermes/.env 读取 XXTEA 密钥。

用法:
    from phone_encrypt import encrypt_phone, decrypt_phone, phone_md5

    cipher = encrypt_phone("13800138000")
    phone  = decrypt_phone(cipher)
    md5    = phone_md5("13800138000")

命令行:
    python phone_encrypt.py encrypt 13800138000
    python phone_encrypt.py decrypt CxMOc6z56aYjE73r8OSAog..
"""

import os
import re
import hashlib
import base64

try:
    import xxtea
except ImportError:
    raise ImportError(
        "请先安装 xxtea: pip install xxtea-py"
    )


def _load_key() -> str:
    """从 ~/.hermes/.env 加载 XXTEA 密钥"""
    env_path = os.path.expanduser("~/.hermes/.env")
    if not os.path.exists(env_path):
        raise FileNotFoundError(f"找不到 .env 文件: {env_path}")

    with open(env_path, "r") as f:
        content = f.read()

    match = re.search(r"VALA_PHONE_XXTEA_KEY=(.+)", content)
    if not match:
        raise ValueError("在 .env 中未找到 VALA_PHONE_XXTEA_KEY")

    return match.group(1).strip().strip('"')


KEY = _load_key()


def encrypt_phone(phone: str) -> str:
    """加密明文手机号，返回与数据库 tel_encrypt 字段一致的密文"""
    encrypted = xxtea.encrypt(phone.encode(), KEY.encode())
    result = base64.b64encode(encrypted).decode()
    result = result.replace("+", "-").replace("/", "_").replace("=", ".")
    return result


def decrypt_phone(encrypted: str) -> str:
    """解密 tel_encrypt 还原明文手机号"""
    restored = encrypted.replace("-", "+").replace("_", "/").replace(".", "=")
    decrypted = xxtea.decrypt(base64.b64decode(restored), KEY.encode())
    return decrypted.decode()


def phone_md5(phone: str) -> str:
    """手机号 MD5（用于跨系统关联）"""
    return hashlib.md5(phone.encode()).hexdigest()


if __name__ == "__main__":
    import sys

    if len(sys.argv) < 3:
        print("用法: python phone_encrypt.py <encrypt|decrypt> <手机号|密文>")
        sys.exit(1)

    action, value = sys.argv[1], sys.argv[2]

    if action == "encrypt":
        print(encrypt_phone(value))
    elif action == "decrypt":
        print(decrypt_phone(value))
    else:
        print(f"未知操作: {action}，支持 encrypt / decrypt")
        sys.exit(1)