/*
 * safe_pgp_sym_decrypt — decrypt-or-NULL wrapper for bulk PII listings.
 *
 * Returns NULL for undecryptable rows (legacy/old-key PII) so a single bad row
 * cannot 500 a bulk listing. NULL here means 'undecryptable', not 'no value'.
 */

CREATE OR REPLACE FUNCTION safe_pgp_sym_decrypt(data bytea, key text) RETURNS text
LANGUAGE plpgsql IMMUTABLE STRICT AS $$
BEGIN
  RETURN pgp_sym_decrypt(data, key);
EXCEPTION WHEN OTHERS THEN
  RETURN NULL;
END;
$$;