import { createDecipheriv } from 'node:crypto';
import { AES_GCM_AUTH_TAG_BYTE_LENGTH } from '../consts/crypto/aesGcmAuthTagByteLength';
import { AES_GCM_IV_BYTE_LENGTH } from '../consts/crypto/aesGcmIvByteLength';
import { AES_GCM_KEY_BYTE_LENGTH } from '../consts/crypto/aesGcmKeyByteLength';

export const decryptAesGcm = (ciphertext: Buffer, key: Buffer, iv: Buffer): Buffer => {
    if (iv.length !== AES_GCM_IV_BYTE_LENGTH) {
        throw new Error(`AES-GCM IV must be ${AES_GCM_IV_BYTE_LENGTH} bytes`);
    }

    if (key.length !== AES_GCM_KEY_BYTE_LENGTH) {
        throw new Error(`AES-GCM key must be ${AES_GCM_KEY_BYTE_LENGTH} bytes`);
    }

    if (ciphertext.length < AES_GCM_AUTH_TAG_BYTE_LENGTH) {
        throw new Error('AES-GCM ciphertext is too short');
    }

    const authTag = ciphertext.subarray(ciphertext.length - AES_GCM_AUTH_TAG_BYTE_LENGTH);
    const encrypted = ciphertext.subarray(0, ciphertext.length - AES_GCM_AUTH_TAG_BYTE_LENGTH);

    const decipher = createDecipheriv('aes-256-gcm', key, iv);

    decipher.setAuthTag(authTag);

    return Buffer.concat([decipher.update(encrypted), decipher.final()]);
};