<?php

namespace WPSN\Core\Secrets;

defined('ABSPATH') || exit;

/**
 * Best-effort migration: encrypt known secret options if they are still stored as plaintext.
 *
 * This runs fast (a few get_option calls) and is safe to run multiple times.
 */
final class SecretsAtRestMigrator
{
    public static function maybeRun(): void
    {
        if (!EncryptedOption::encryptionAvailable()) {
            return;
        }

        // Arrays.
        foreach ([
            'wpsn_ai_secrets',
            'wpsn_gsc_secrets',
            'wpsn_saas_secrets',
            'wpsn_license_secrets',
            'wpsn_serp_secrets',
        ] as $opt) {
            try {
                EncryptedOption::maybeEncryptLegacyArray($opt);
            } catch (\Throwable $e) {
                // Never break site load.
            }
        }

        // Strings.
        try {
            EncryptedOption::maybeEncryptLegacyString('wpsn_config_sync_secret');
        } catch (\Throwable $e) {
            // Never break site load.
        }
    }
}
