import hashlib
import uuid
import platform

# SECRET_SALT: Change this to something unique before selling!
# This connects the KeyGen to the App.
SECRET_SALT = "ServiceGuard_2025_Secure_Salt_9988"

def generate_license_key(user_ref):
    """Generates a key based on a user reference (e.g. gumroad email)."""
    # Create a hash of the salt + user_ref
    raw_str = f"{SECRET_SALT}-{user_ref.strip().lower()}"
    hash_object = hashlib.sha256(raw_str.encode())
    hex_dig = hash_object.hexdigest().upper()
    
    # Format: SG-XXXX-XXXX-XXXX (First 12 chars of hash)
    return f"SG-{hex_dig[:4]}-{hex_dig[4:8]}-{hex_dig[8:12]}"

def verify_license_key(user_ref, input_key):
    """Verifies that the input key matches the generated key for that user."""
    expected_key = generate_license_key(user_ref)
    return input_key.strip() == expected_key

import base64

def encrypt_secret(plaintext):
    """Encrypt sensitive credentials before storing to disk."""
    if not plaintext or str(plaintext).startswith("ENC:"):
        return plaintext
    key_bytes = hashlib.sha256(SECRET_SALT.encode('utf-8')).digest()
    pt_bytes = str(plaintext).strip().encode('utf-8')
    ct_hex = []
    for i, b in enumerate(pt_bytes):
        ct_hex.append(f"{b ^ key_bytes[i % len(key_bytes)]:02x}")
    return "ENC:" + "".join(ct_hex)

def decrypt_secret(ciphertext):
    """Decrypt stored credentials back into RAM for authentication."""
    if not ciphertext or not str(ciphertext).startswith("ENC:"):
        return ciphertext
    try:
        raw_hex = str(ciphertext)[4:].strip()
        ct_bytes = bytes.fromhex(raw_hex)
        key_bytes = hashlib.sha256(SECRET_SALT.encode('utf-8')).digest()
        pt_bytes = bytearray()
        for i, b in enumerate(ct_bytes):
            pt_bytes.append(b ^ key_bytes[i % len(key_bytes)])
        return pt_bytes.decode('utf-8', errors='ignore')
    except Exception:
        return ""