import base64
import hashlib
from cryptography.fernet import Fernet


def _fernet_from_secret(secret: str) -> Fernet:
    digest = hashlib.sha256(secret.encode("utf-8")).digest()
    return Fernet(base64.urlsafe_b64encode(digest))


def encrypt_secret(value: str | None, *, secret: str) -> str | None:
    if not value:
        return None
    return _fernet_from_secret(secret).encrypt(value.encode()).decode()


def decrypt_secret(value: str | None, *, secret: str) -> str | None:
    if not value:
        return None
    return _fernet_from_secret(secret).decrypt(value.encode()).decode()