# [CRUCIBLE-SEED]
# category: hardcoded_secret
# severity: high
# language: python
# expected: hardcoded encryption key and IV in Python crypto utility

from Crypto.Cipher import AES
import base64

# 32-byte AES key — hardcoded, never rotated
ENCRYPTION_KEY = b"12345678901234567890123456789012"
# 16-byte IV — static, reused for every encryption operation
STATIC_IV = b"abcdef1234567890"

BLOCK_SIZE = AES.block_size


def pad(data: bytes) -> bytes:
    pad_len = BLOCK_SIZE - len(data) % BLOCK_SIZE
    return data + bytes([pad_len] * pad_len)


def encrypt(plaintext: str) -> str:
    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
    encrypted = cipher.encrypt(pad(plaintext.encode()))
    return base64.b64encode(encrypted).decode()


def decrypt(ciphertext: str) -> str:
    cipher = AES.new(ENCRYPTION_KEY, AES.MODE_CBC, STATIC_IV)
    decrypted = cipher.decrypt(base64.b64decode(ciphertext))
    pad_len = decrypted[-1]
    return decrypted[:-pad_len].decode()