export async function encryptFile(file: File, password: string) {
  const salt = crypto.getRandomValues(new Uint8Array(16))
  const iv = crypto.getRandomValues(new Uint8Array(12))

  const keyMaterial = await getKeyMaterial(password)
  const key = await deriveKey(keyMaterial, salt)

  const fileBuffer = await file.arrayBuffer()
  const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, fileBuffer)

  const encryptedBytes = new Uint8Array(encrypted)

  // Combine salt + iv + encrypted data
  const combined = new Uint8Array(salt.length + iv.length + encryptedBytes.length)
  combined.set(salt, 0)
  combined.set(iv, salt.length)
  combined.set(encryptedBytes, salt.length + iv.length)

  return {
    encryptedBlob: new Blob([combined], { type: 'application/octet-stream' }),
    metadata: {
      salt: Array.from(salt),
      iv: Array.from(iv)
    }
  }
}

async function getKeyMaterial(password: string) {
  const enc = new TextEncoder()
  return crypto.subtle.importKey(
    'raw',
    enc.encode(password),
    { name: 'PBKDF2' },
    false,
    ['deriveKey']
  )
}

// export async function decryptBlob(blob: Blob, password: string): Promise<Blob> {
//   const combined = new Uint8Array(await blob.arrayBuffer())

//   const salt = combined.slice(0, 16)
//   const iv = combined.slice(16, 28)
//   const data = combined.slice(28)

//   const keyMaterial = await getKeyMaterial(password)
//   const key = await deriveKey(keyMaterial, salt)

//   const decrypted = await crypto.subtle.decrypt(
//     { name: 'AES-GCM', iv },
//     key,
//     data
//   )

//   return new Blob([decrypted])
// }


async function deriveKey(keyMaterial: CryptoKey, salt: Uint8Array) {
  return crypto.subtle.deriveKey(
    {
      name: 'PBKDF2',
      salt,
      iterations: 100000,
      hash: 'SHA-256'
    },
    keyMaterial,
    { name: 'AES-GCM', length: 256 },
    false,
    ['encrypt', 'decrypt']
  )
}

export async function encryptBlob(blob: Blob, password: string) {
  const pwUtf8 = new TextEncoder().encode(password)
  const pwHash = await crypto.subtle.digest('SHA-256', pwUtf8)
  const iv = crypto.getRandomValues(new Uint8Array(12))

  const key = await crypto.subtle.importKey('raw', pwHash, 'AES-GCM', false, ['encrypt'])
  const content = new Uint8Array(await blob.arrayBuffer())

  const encrypted = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, content)
  const encryptedBlob = new Blob([iv, new Uint8Array(encrypted)])

  return { encryptedBlob }
}

export async function decryptBlob(encryptedBlob: Blob, password: string) {
  const data = new Uint8Array(await encryptedBlob.arrayBuffer())
  const iv = data.slice(0, 12)
  const encrypted = data.slice(12)

  const pwUtf8 = new TextEncoder().encode(password)
  const pwHash = await crypto.subtle.digest('SHA-256', pwUtf8)
  const key = await crypto.subtle.importKey('raw', pwHash, 'AES-GCM', false, ['decrypt'])

  const decrypted = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, encrypted)
  return new Blob([decrypted])
}