app_for_reddit/Reddit App/Managers/EncryptedOpenAIKey.swift

import Foundation

/// Runtime-decoded OpenAI credentials bundled with the app.
/// The key is XOR-obfuscated so it does not appear as plain text in source or strings tables.
enum EncryptedOpenAIKey {
    private static let obfuscatedPayload: [UInt8] = [
        33, 14, 73, 23, 25, 17, 0, 34, 42, 39, 72, 39, 6, 89, 13, 21, 34, 11, 40, 91,
        120, 112, 89, 106, 63, 15, 30, 94, 23, 8, 37, 124, 10, 22, 62, 63, 47, 78, 21, 15,
        55, 12, 104, 119, 7, 1, 57, 19, 28, 3, 48, 22, 87, 44, 61, 107, 43, 54, 46, 7, 91,
        49, 30, 44, 29, 94, 96, 87, 93, 59, 7, 37, 10, 28, 65, 24, 4, 4, 25, 19, 25, 37, 25,
        14, 43, 31, 86, 59, 94, 82, 89, 112, 24, 86, 22, 35, 30, 36, 53, 21, 38, 97, 81, 53,
        69, 94, 32, 20, 127, 63, 53, 2, 103, 81, 64, 4, 38, 49, 12, 61, 70, 9, 22, 16, 11, 12,
        56, 35, 8, 22, 40, 18, 93, 51, 122, 106, 115, 4, 27, 8, 13, 32, 91, 32, 62, 50, 46, 22,
        48, 30, 3, 5, 6, 85, 44, 36, 46, 109, 65, 4, 105, 8, 40, 29, 60, 28, 51,
    ]

    private static var maskBytes: [UInt8] {
        Array("ReddoraAI".utf8) + Array("ServiceKey".utf8) + Array("2026".utf8)
    }

    static func resolve() -> String? {
        let mask = maskBytes
        guard !mask.isEmpty else { return nil }

        var decoded = [UInt8]()
        decoded.reserveCapacity(obfuscatedPayload.count)

        for (index, byte) in obfuscatedPayload.enumerated() {
            decoded.append(byte ^ mask[index % mask.count])
        }

        guard let key = String(bytes: decoded, encoding: .utf8),
              key.hasPrefix("sk-"),
              !key.isEmpty else {
            return nil
        }

        return key
    }
}