ldaü

src/App/RegistrationSecretBox.php

@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App;
+
+use RuntimeException;
+
+final class RegistrationSecretBox
+{
+    private const CIPHER = 'aes-256-gcm';
+
+    public function __construct(
+        private readonly string $keyMaterial,
+    ) {
+    }
+
+    public function isConfigured(): bool
+    {
+        return trim($this->keyMaterial) !== '';
+    }
+
+    public function encrypt(string $plaintext): string
+    {
+        $key = $this->normalizedKey();
+        $iv = random_bytes(12);
+        $tag = '';
+        $ciphertext = openssl_encrypt($plaintext, self::CIPHER, $key, OPENSSL_RAW_DATA, $iv, $tag);
+
+        if ($ciphertext === false) {
+            throw new RuntimeException('Das Passwort konnte nicht verschlüsselt werden.');
+        }
+
+        return base64_encode($iv . $tag . $ciphertext);
+    }
+
+    public function decrypt(string $encoded): string
+    {
+        $raw = base64_decode($encoded, true);
+
+        if ($raw === false || strlen($raw) < 28) {
+            throw new RuntimeException('Das gespeicherte Passwort ist beschädigt.');
+        }
+
+        $key = $this->normalizedKey();
+        $iv = substr($raw, 0, 12);
+        $tag = substr($raw, 12, 16);
+        $ciphertext = substr($raw, 28);
+        $plaintext = openssl_decrypt($ciphertext, self::CIPHER, $key, OPENSSL_RAW_DATA, $iv, $tag);
+
+        if ($plaintext === false) {
+            throw new RuntimeException('Das gespeicherte Passwort konnte nicht entschlüsselt werden.');
+        }
+
+        return $plaintext;
+    }
+
+    private function normalizedKey(): string
+    {
+        if (!$this->isConfigured()) {
+            throw new RuntimeException('REGISTRATION_PASSWORD_KEY ist nicht gesetzt.');
+        }
+
+        $trimmed = trim($this->keyMaterial);
+        $decoded = base64_decode($trimmed, true);
+
+        if ($decoded !== false && strlen($decoded) >= 32) {
+            return substr($decoded, 0, 32);
+        }
+
+        return hash('sha256', $trimmed, true);
+    }
+}