<?php
/**
 * 需要用到 腾讯云开发者工具套件（SDK）3.0 获取地址 https://github.com/TencentCloud/tencentcloud-sdk-php
 * 万象控制台配置转码文件的 UriKey 之后，该接口的处理逻辑参考以下 demo
 * 1) 获取到密文 $_GET['Ciphertext']
 * 2) 请求 KMS Decrypt 接口，拿到响应后 进行 base64解码
 * 3) 接口返回 解码后的字符串
 */

require_once './tencentcloud-sdk-php/vendor/autoload.php';

use TencentCloud\\Common\\Credential;
use TencentCloud\\Kms\\V20190118\\KmsClient;
use TencentCloud\\Kms\\V20190118\\Models\\DecryptRequest;
use TencentCloud\\Common\\Exception\\TencentCloudSDKException;

$secretId = "";
$secretKey = "";
$ciphertext = $_GET['Ciphertext'];
$kmsRegion = $_GET['KMSRegion'];

try {
    $cred = new Credential($secretId, $secretKey);
    $kmsClient = new KmsClient($cred, $kmsRegion);

    $decryptRequest = new DecryptRequest();
    $decryptRequest->setCiphertextBlob($ciphertext);
    $resp = $kmsClient->Decrypt($decryptRequest);
    $plaintext = $resp->getPlaintext();
    $decodeStr = base64_decode($plaintext);

    echo $decodeStr;
}
catch(TencentCloudSDKException $e) {
    echo $e;
}

@RestController
@CrossOrigin("*")
public class KMSDecryptController {

    @RequestMapping("decrypt")
    public void decrypt(@RequestParam("Ciphertext") String ciphertext,@RequestParam("KMSRegion") String region, HttpServletResponse response) {
        try {
            // 实例化一个认证对象，入参需要传入腾讯云账户 secretId，secretKey,此处还需注意密钥对的保密
            // 密钥可前往 https://console.cloud.tencent.com/cam/capi 网站进行获取
            Credential cred = new Credential("", "");
            // 实例化 http
            HttpProfile httpProfile = new HttpProfile();
            httpProfile.setEndpoint("kms.tencentcloudapi.com");
            // 实例化一个 client 选项，可选的，没有特殊需求可以跳过
            ClientProfile clientProfile = new ClientProfile();
            clientProfile.setHttpProfile(httpProfile);
            // 实例化要请求产品的 client 对象,clientProfile 是可选的
            KmsClient client = new KmsClient(cred, region, clientProfile);
            // 实例化一个请求对象,每个接口都会对应一个 request 对象
            DecryptRequest req = new DecryptRequest();
            //写入待解密数据
            req.setCiphertextBlob(ciphertext);
            // 返回的 resp 是一个 DecryptResponse 的实例，与请求对象对应
            DecryptResponse resp = client.Decrypt(req);
            String plaintext = resp.getPlaintext();
            //对秘钥进行 base64解密
            byte[] decode = Base64.getDecoder().decode(plaintext);
            //返回流
            ServletOutputStream outputStream = response.getOutputStream();
            outputStream.write(decode);
            outputStream.close();
        } catch (TencentCloudSDKException | IOException e) {
            System.out.println(e.toString());
        }
    }
}