//! Cipher trait for at-rest encryption of stored bytes.
//!
//! peat-mesh stays crypto-agnostic — this trait is a pure boundary that
//! `AutomergeStore` calls before redb writes and after redb reads.
//! Implementations live in consumer crates (peat-node provides
//! AES-256-GCM via its `StoreCipher`).
//!
//! Scope is **document bytes only** as of this version. Tombstones in
//! the `TOMBSTONES_TABLE` are stored plaintext; if their metadata
//! (document IDs, collection names, deletion reasons) needs protection
//! too, that's a separate follow-up.

use anyhow::Result;

/// Wraps the byte-storage I/O of [`AutomergeStore`](super::automerge_store::AutomergeStore)
/// so document bytes can be encrypted at rest.
///
/// Implementations must be `Debug + Send + Sync`:
/// - `Send + Sync` because the cipher is held inside `Arc<dyn Cipher>`
///   and dispatched from multiple sync and CRUD paths.
/// - `Debug` so structs that hold a `Cipher` (notably
///   `AutomergeBackendConfig`) can derive `Debug`. Implementations
///   are expected to redact key material in their `Debug` output.
///
/// Errors are surfaced as `anyhow::Error`; the store treats any cipher
/// error as fatal for that I/O — there is no partial-decrypt fallback.
pub trait Cipher: std::fmt::Debug + Send + Sync {
    /// Encrypt plaintext bytes for storage. Must be inverse of `decrypt`
    /// for any output of this method called with the same `&self`.
    fn encrypt(&self, plaintext: &[u8]) -> Result<Vec<u8>>;

    /// Decrypt ciphertext bytes read from storage.
    fn decrypt(&self, ciphertext: &[u8]) -> Result<Vec<u8>>;
}
