import { createDbService } from '@/server/services/db.js';
/**
 * PII helpers: decrypt vendor phone via pgp_sym_decrypt.
 * Mirrors decrypt-email.ts — swaps vendors.email → vendors.phone.
 */

import { eq, sql } from 'drizzle-orm';
import { vendors } from '../../../db/schema.js';
import { captureCaught } from '@/server/observability/capture.server';
import type { DispatchEnv } from '../types.js';

export async function decryptVendorPhone(
  env: DispatchEnv,
  vendorId: string,
): Promise<string | null> {
  if (!env.PII_KEY) return null;
  const db = createDbService({ DATABASE_URL: env.DATABASE_URL });
  try {
    const rows = await db
      .select({
        phone: sql<string>`pgp_sym_decrypt(CASE WHEN substring(${vendors.phone}, 1, 2) = '\\x' THEN ${vendors.phone}::bytea ELSE decode(${vendors.phone}, 'base64') END, ${env.PII_KEY})::text`,
      })
      .from(vendors)
      .where(eq(vendors.id, vendorId))
      .limit(1);
    return rows[0]?.phone ?? null;
  } catch (err) {
    captureCaught(err, { scope: 'server.workflows.outbox.decrypt-phone', severity: 'warning' });
    return null;
  }
}