# Chiavi derivate da SECRET_KEY_BASE così le password SMTP restano cifrate
# anche senza rails credentials:edit (Docker / deploy).
#
# In Rails 8 il getter di ActiveRecord::Encryption.config.primary_key solleva
# se la chiave manca: non usare ||= su quell'oggetto.
require "digest"

secret = Rails.application.secret_key_base.to_s
keys = {
  primary_key: Digest::SHA256.hexdigest("#{secret}/ar-enc-primary"),
  deterministic_key: Digest::SHA256.hexdigest("#{secret}/ar-enc-deterministic"),
  key_derivation_salt: Digest::SHA256.hexdigest("#{secret}/ar-enc-salt")
}

cfg = Rails.application.config.active_record.encryption
keys.each { |name, value| cfg[name] = value }
cfg.support_unencrypted_data = true

Rails.application.config.after_initialize do
  enc = ActiveRecord::Encryption.config
  enc.primary_key = keys[:primary_key]
  enc.deterministic_key = keys[:deterministic_key]
  enc.key_derivation_salt = keys[:key_derivation_salt]
  enc.support_unencrypted_data = true
end