import json
import os
import base64
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC

CONFIG_FILE = os.path.join(os.path.dirname(__file__), 'config.json')

class ConfigManager:
    def __init__(self, password=None):
        self.password = password  # optional master password; if None, use plain text

    def load(self):
        if os.path.exists(CONFIG_FILE):
            with open(CONFIG_FILE, 'r') as f:
                data = json.load(f)
            # decrypt sensitive fields if password provided
            if self.password and 'encrypted' in data:
                fernet = self._get_fernet()
                for key in ['api_secret', 'telegram_token']:
                    if key in data:
                        data[key] = fernet.decrypt(data[key].encode()).decode()
            return data
        return {}

    def save(self, config):
        if self.password:
            fernet = self._get_fernet()
            # encrypt sensitive fields
            for key in ['api_secret', 'telegram_token']:
                if key in config and config[key]:
                    config[key] = fernet.encrypt(config[key].encode()).decode()
            config['encrypted'] = True
        with open(CONFIG_FILE, 'w') as f:
            json.dump(config, f, indent=2)

    def _get_fernet(self):
        if not self.password:
            raise ValueError("No password set")
        salt = b'adaptive_hedge_salt'  # fixed salt, could be generated once
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=100000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(self.password.encode()))
        return Fernet(key)