/**
 * GDPRAuditBot -- Automated GDPR compliance auditing.
 *
 * Inspects the governance directory structure to verify that GDPR
 * data protection controls are in place. Checks for file existence,
 * configuration presence, and control readiness. Does NOT call external APIs.
 *
 * GATE 11: Compliance Audit Bot System (T-156)
 *
 * @connexum/ai-governance
 */
import * as fs from 'fs';
import * as path from 'path';
import { computeAuditScore, } from './scheduler.js';
export class GDPRAuditBot {
    logDir;
    governanceDir;
    constructor(config) {
        this.logDir = config.logDir;
        this.governanceDir = config.governanceDir;
    }
    /**
     * Run the full GDPR audit.
     */
    runAudit() {
        const checks = [
            this.checkLawfulness(),
            this.checkDataMinimizationCapabilities(),
            this.checkDataMinimizationPaths(),
            this.checkTransparencyGovernance(),
            this.checkTransparencyAuditTrail(),
            this.checkSecurityEncryption(),
            this.checkSecurityAccessControls(),
            this.checkSecurityIntegrity(),
            this.checkDPIA(),
            this.checkDataSubjectExport(),
            this.checkDataSubjectDeletion(),
            this.checkBreachNotification(),
        ];
        const { score, passed, failed, warnings } = computeAuditScore(checks);
        return {
            auditId: '',
            packId: 'gdpr',
            timestamp: new Date().toISOString(),
            checks,
            score,
            passed,
            failed,
            warnings,
        };
    }
    // --- Art. 6: Lawfulness of Processing ---
    checkLawfulness() {
        const processingBasis = path.join(this.governanceDir, 'processing-basis.json');
        const govFile = path.join(this.governanceDir, 'governance.json');
        const exists = fs.existsSync(processingBasis) || fs.existsSync(govFile);
        return {
            id: 'gdpr-art6-lawfulness',
            title: 'Art. 6: Processing basis documented',
            status: exists ? 'pass' : 'warning',
            detail: exists
                ? 'Processing basis documentation found'
                : 'No processing-basis.json or governance.json -- lawful basis may not be documented',
            evidence: exists
                ? [processingBasis, govFile].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
    // --- Art. 5: Data Minimization ---
    checkDataMinimizationCapabilities() {
        const capFile = path.join(this.governanceDir, 'capability-bundles.json');
        const exists = fs.existsSync(capFile);
        return {
            id: 'gdpr-art5-capabilities',
            title: 'Art. 5: Capability bundles (data minimization)',
            status: exists ? 'pass' : 'warning',
            detail: exists
                ? 'Capability bundles limit agent data access'
                : 'No capability-bundles.json -- data minimization may not be enforced',
            evidence: exists ? capFile : undefined,
        };
    }
    checkDataMinimizationPaths() {
        const permFile = path.join(this.governanceDir, 'permissions.json');
        const permMd = path.join(this.governanceDir, 'PERMISSIONS.md');
        const exists = fs.existsSync(permFile) || fs.existsSync(permMd);
        return {
            id: 'gdpr-art5-paths',
            title: 'Art. 5: Path restrictions',
            status: exists ? 'pass' : 'warning',
            detail: exists
                ? 'Path restriction permissions found'
                : 'No permissions file -- path restrictions not defined',
            evidence: exists
                ? [permFile, permMd].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
    // --- Art. 13-14: Transparency ---
    checkTransparencyGovernance() {
        const govFile = path.join(this.governanceDir, 'governance.json');
        const exists = fs.existsSync(govFile);
        return {
            id: 'gdpr-art13-governance',
            title: 'Art. 13-14: Governance rules visible',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Governance rules file accessible for transparency'
                : 'Missing governance.json -- governance rules not visible to data subjects',
            evidence: exists ? govFile : undefined,
        };
    }
    checkTransparencyAuditTrail() {
        const hasLogs = fs.existsSync(this.logDir) &&
            fs.readdirSync(this.logDir).some((f) => f.endsWith('.jsonl'));
        return {
            id: 'gdpr-art13-audit-trail',
            title: 'Art. 13-14: Audit trail for transparency',
            status: hasLogs ? 'pass' : 'warning',
            detail: hasLogs
                ? 'Audit trail available for data subject inquiries'
                : 'No audit logs -- transparency trail not available',
            evidence: hasLogs ? this.logDir : undefined,
        };
    }
    // --- Art. 32: Security of Processing ---
    checkSecurityEncryption() {
        const encConfig = path.join(this.governanceDir, 'encryption.json');
        const exists = fs.existsSync(encConfig);
        return {
            id: 'gdpr-art32-encryption',
            title: 'Art. 32: Encryption',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Encryption configuration found per Art. 32'
                : 'Missing encryption.json -- data not encrypted',
            evidence: exists ? encConfig : undefined,
        };
    }
    checkSecurityAccessControls() {
        const authFile = path.join(this.governanceDir, 'agent-auth.json');
        const exists = fs.existsSync(authFile);
        return {
            id: 'gdpr-art32-access',
            title: 'Art. 32: Access controls',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Agent authentication provides access control'
                : 'Missing agent-auth.json -- access controls not configured',
            evidence: exists ? authFile : undefined,
        };
    }
    checkSecurityIntegrity() {
        const hashFile = path.join(this.governanceDir, 'hash-manifest.json');
        const exists = fs.existsSync(hashFile);
        return {
            id: 'gdpr-art32-integrity',
            title: 'Art. 32: Integrity verification',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Hash manifest provides integrity verification'
                : 'Missing hash-manifest.json -- integrity not verifiable',
            evidence: exists ? hashFile : undefined,
        };
    }
    // --- Art. 35: DPIA ---
    checkDPIA() {
        const anomalyConfig = path.join(this.governanceDir, 'anomaly-detection.json');
        const riskConfig = path.join(this.governanceDir, 'risk-assessment.json');
        const exists = fs.existsSync(anomalyConfig) || fs.existsSync(riskConfig);
        return {
            id: 'gdpr-art35-dpia',
            title: 'Art. 35: DPIA readiness',
            status: exists ? 'pass' : 'warning',
            detail: exists
                ? 'Risk assessment capabilities found'
                : 'No anomaly-detection.json or risk-assessment.json -- DPIA capabilities limited',
            evidence: exists
                ? [anomalyConfig, riskConfig].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
    // --- Art. 15-22: Data Subject Rights ---
    checkDataSubjectExport() {
        const exportConfig = path.join(this.governanceDir, 'data-export.json');
        const dsrConfig = path.join(this.governanceDir, 'data-subject-rights.json');
        const exists = fs.existsSync(exportConfig) || fs.existsSync(dsrConfig);
        return {
            id: 'gdpr-art15-export',
            title: 'Art. 15-22: Data export capability',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Data export/subject rights configuration found'
                : 'No data-export.json or data-subject-rights.json -- data portability not configured',
            evidence: exists
                ? [exportConfig, dsrConfig].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
    checkDataSubjectDeletion() {
        const deleteConfig = path.join(this.governanceDir, 'data-deletion.json');
        const dsrConfig = path.join(this.governanceDir, 'data-subject-rights.json');
        const exists = fs.existsSync(deleteConfig) || fs.existsSync(dsrConfig);
        return {
            id: 'gdpr-art17-deletion',
            title: 'Art. 15-22: Data deletion capability',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Data deletion/subject rights configuration found'
                : 'No data-deletion.json or data-subject-rights.json -- right to erasure not supported',
            evidence: exists
                ? [deleteConfig, dsrConfig].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
    // --- Art. 33-34: Breach Notification ---
    checkBreachNotification() {
        const notifyConfig = path.join(this.governanceDir, 'incident-notification.json');
        const irConfig = path.join(this.governanceDir, 'incident-response.json');
        const exists = fs.existsSync(notifyConfig) || fs.existsSync(irConfig);
        return {
            id: 'gdpr-art33-breach',
            title: 'Art. 33-34: Breach notification',
            status: exists ? 'pass' : 'fail',
            detail: exists
                ? 'Incident notification configured for 72-hour breach reporting'
                : 'No incident-notification.json or incident-response.json -- breach notification not configured',
            evidence: exists
                ? [notifyConfig, irConfig].filter((f) => fs.existsSync(f)).join(', ')
                : undefined,
        };
    }
}
//# sourceMappingURL=gdpr.js.map