<?php

namespace App\Console\Commands;

use App\Http\Facade\SignRSA;
use Illuminate\Console\Command;
use Illuminate\Support\Facades\Crypt;
use Illuminate\Support\Facades\DB;

class EncryptVCenterPasswords extends Command
{
    protected $signature = 'vcenter:encrypt-passwords';
    protected $description = 'Re-encrypt vCenter passwords from Laravel encrypted cast to SignRSA format';

    public function handle(): int
    {
        $rows = DB::table('module_vcenter')->get(['id', 'password']);
        $fixed = 0;

        foreach ($rows as $row) {
            if (!$row->password) continue;

            // Try to decrypt as Laravel encrypted cast (from previous migration)
            $plainPassword = null;
            try {
                $plainPassword = Crypt::decryptString($row->password);
                $this->info("vCenter #{$row->id}: detected Laravel encrypted password, will re-encrypt with SignRSA");
            } catch (\Exception) {
                // Not Laravel encrypted — check if it's already SignRSA or plain text
                $decrypted = SignRSA::DecryptFunc($row->password);
                if ($decrypted) {
                    $this->info("vCenter #{$row->id}: already SignRSA encrypted, skipping");
                    continue;
                }
                // Plain text password
                $plainPassword = $row->password;
                $this->info("vCenter #{$row->id}: detected plain text password, will encrypt with SignRSA");
            }

            if ($plainPassword) {
                $encrypted = SignRSA::EncryptFunc($plainPassword);
                DB::table('module_vcenter')
                    ->where('id', $row->id)
                    ->update(['password' => $encrypted]);
                $fixed++;
                $this->info("vCenter #{$row->id}: re-encrypted successfully");
            }
        }

        $this->info("Done. Fixed {$fixed} password(s).");
        return 0;
    }
}