DIGITAL
SANCTUARY

import CryptoKit

final class VaultCrypto {

  /// Encrypts photo data with ChaCha20-Poly1305 AEAD
  static func encryptData(_ data: Data, key: SymmetricKey) throws -> Data {
    // ChaCha20-Poly1305 provides:
    // - Confidentiality (encryption)
    // - Authenticity (HMAC)
    // - Integrity (tampering detection)
    let sealedBox = try ChaChaPoly.seal(data, using: key)

    return sealedBox.combined // Nonce + Ciphertext + Tag
  }

  /// Decrypts vault photo
  static func decryptData(_ encryptedData: Data, key: SymmetricKey) throws -> Data {
    let sealedBox = try ChaChaPoly.SealedBox(combined: encryptedData)

    // Authentication tag verified automatically
    // Throws error if data has been tampered with
    let decryptedData = try ChaChaPoly.open(sealedBox, using: key)

    return decryptedData
  }

  /// Generates vault encryption key with entropy validation
  static func generateVaultKey() throws -> SymmetricKey {
    let key = SymmetricKey(size: .bits256)

    // Validate entropy meets NIST SP 800-90B standards
    let keyData = key.withUnsafeBytes { Data($0) }
    let entropy = calculateEntropy(keyData)

    guard entropy >= 7.5 else {
      throw CryptoError.insufficientEntropy
    }

    return key
  }
}