import NanoTDF from './NanoTDF.js';
import Header from './models/Header.js';
import ResourceLocator from './models/ResourceLocator.js';
import DefaultParams from './models/DefaultParams.js';
import EmbeddedPolicy from './models/Policy/EmbeddedPolicy.js';
import Payload from './models/Payload.js';
import getHkdfSalt from './helpers/getHkdfSalt.js';
import { getBitLength as authTagLengthForCipher } from './models/Ciphers.js';
import { lengthOfBinding } from './helpers/calculateByCipher.js';
import { encrypt as cryptoEncrypt, keyAgreement, extractPublicFromCertToCrypto, digest, exportCryptoKey, } from '../nanotdf-crypto/index.js';
/**
 * Encrypt the plain data into nanotdf buffer
 *
 * @param policy Policy that will added to the nanotdf
 * @param kasPubCrtAsPem KAS public crt in pem format
 * @param kasUrl KAS url as string
 * @param ephemeralKeyPair SDK ephemeral key pair to generate symmetric key
 * @param data The data to be encrypted
 */
export default async function encrypt(policy, kasPubCrtAsPem, kasUrl, ephemeralKeyPair, iv, data) {
    // Generate a symmetric key.
    if (!ephemeralKeyPair.privateKey) {
        throw new Error('incomplete ephemeral key');
    }
    const symmetricKey = await keyAgreement(ephemeralKeyPair.privateKey, 
    // Get session public key as crypto key
    await extractPublicFromCertToCrypto(kasPubCrtAsPem), 
    // Get the hkdf salt params
    await getHkdfSalt(DefaultParams.magicNumberVersion));
    // Construct the kas locator
    const kasResourceLocator = ResourceLocator.parse(kasUrl);
    // Auth tag length for policy and payload
    const authTagLengthInBytes = authTagLengthForCipher(DefaultParams.symmetricCipher) / 8;
    // Encrypt the policy
    const policyIV = new Uint8Array(iv.length).fill(0);
    const policyAsBuffer = new TextEncoder().encode(policy);
    const encryptedPolicy = await cryptoEncrypt(symmetricKey, policyAsBuffer, policyIV, authTagLengthInBytes * 8);
    // Enable - once ecdsaBinding is true
    // if (!DefaultParams.ecdsaBinding) {
    //   throw new Error("ECDSA binding should enable by default.");
    // }
    // // Calculate the policy binding.
    // const policyBinding = await calculateSignature(this.ephemeralKeyPair.privateKey, new Uint8Array(encryptedPolicy));
    // console.log("Length of the policyBinding " + policyBinding.byteLength);
    // // Create embedded policy
    // const embeddedPolicy = new EmbeddedPolicy(DefaultParams.policyType,
    //   new Uint8Array(policyBinding),
    //   new Uint8Array(encryptedPolicy)
    // );
    // Calculate the policy binding.
    const lengthOfPolicyBinding = lengthOfBinding(DefaultParams.ecdsaBinding, DefaultParams.ephemeralCurveName);
    const policyBinding = await digest('SHA-256', new Uint8Array(encryptedPolicy));
    // Create embedded policy
    const embeddedPolicy = new EmbeddedPolicy(DefaultParams.policyType, new Uint8Array(policyBinding.slice(-lengthOfPolicyBinding)), new Uint8Array(encryptedPolicy));
    if (!ephemeralKeyPair.publicKey) {
        throw new Error('incomplete ephemeral key');
    }
    // Create a header
    const pubKeyAsArrayBuffer = await exportCryptoKey(ephemeralKeyPair.publicKey);
    const header = new Header(DefaultParams.magicNumberVersion, kasResourceLocator, DefaultParams.ecdsaBinding, DefaultParams.signatureCurveName, DefaultParams.signature, DefaultParams.signatureCurveName, DefaultParams.symmetricCipher, embeddedPolicy, new Uint8Array(pubKeyAsArrayBuffer));
    // Encrypt the payload
    let payloadAsBuffer;
    if (typeof data === 'string') {
        payloadAsBuffer = new TextEncoder().encode(data);
    }
    else {
        payloadAsBuffer = data;
    }
    const encryptedPayload = await cryptoEncrypt(symmetricKey, new Uint8Array(payloadAsBuffer), iv, authTagLengthInBytes * 8);
    // Create payload
    const payload = new Payload(iv.slice(-3), new Uint8Array(encryptedPayload.slice(0, -authTagLengthInBytes)), new Uint8Array(encryptedPayload.slice(-authTagLengthInBytes)));
    // Create a nanotdf.
    const nanoTDF = new NanoTDF(header, payload);
    return nanoTDF.toBuffer();
}
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW5jcnlwdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9uYW5vdGRmL2VuY3J5cHQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxPQUFPLE1BQU0sV0FBVyxDQUFDO0FBQ2hDLE9BQU8sTUFBTSxNQUFNLGlCQUFpQixDQUFDO0FBQ3JDLE9BQU8sZUFBZSxNQUFNLDBCQUEwQixDQUFDO0FBQ3ZELE9BQU8sYUFBYSxNQUFNLHdCQUF3QixDQUFDO0FBQ25ELE9BQU8sY0FBYyxNQUFNLGdDQUFnQyxDQUFDO0FBQzVELE9BQU8sT0FBTyxNQUFNLGtCQUFrQixDQUFDO0FBQ3ZDLE9BQU8sV0FBVyxNQUFNLHVCQUF1QixDQUFDO0FBQ2hELE9BQU8sRUFBRSxZQUFZLElBQUksc0JBQXNCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUMxRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFHOUQsT0FBTyxFQUNMLE9BQU8sSUFBSSxhQUFhLEVBQ3hCLFlBQVksRUFDWiw2QkFBNkIsRUFDN0IsTUFBTSxFQUNOLGVBQWUsR0FDaEIsTUFBTSx5QkFBeUIsQ0FBQztBQUVqQzs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxVQUFVLE9BQU8sQ0FDbkMsTUFBYyxFQUNkLGNBQXNCLEVBQ3RCLE1BQWMsRUFDZCxnQkFBK0IsRUFDL0IsRUFBYyxFQUNkLElBQXVDO0lBRXZDLDRCQUE0QjtJQUM1QixJQUFJLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxFQUFFO1FBQ2hDLE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztLQUM3QztJQUNELE1BQU0sWUFBWSxHQUFHLE1BQU0sWUFBWSxDQUNyQyxnQkFBZ0IsQ0FBQyxVQUFVO0lBQzNCLHVDQUF1QztJQUN2QyxNQUFNLDZCQUE2QixDQUFDLGNBQWMsQ0FBQztJQUNuRCwyQkFBMkI7SUFDM0IsTUFBTSxXQUFXLENBQUMsYUFBYSxDQUFDLGtCQUFrQixDQUFDLENBQ3BELENBQUM7SUFFRiw0QkFBNEI7SUFDNUIsTUFBTSxrQkFBa0IsR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRXpELHlDQUF5QztJQUN6QyxNQUFNLG9CQUFvQixHQUFHLHNCQUFzQixDQUFDLGFBQWEsQ0FBQyxlQUFlLENBQUMsR0FBRyxDQUFDLENBQUM7SUFFdkYscUJBQXFCO0lBQ3JCLE1BQU0sUUFBUSxHQUFHLElBQUksVUFBVSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbkQsTUFBTSxjQUFjLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDeEQsTUFBTSxlQUFlLEdBQUcsTUFBTSxhQUFhLENBQ3pDLFlBQVksRUFDWixjQUFjLEVBQ2QsUUFBUSxFQUNSLG9CQUFvQixHQUFHLENBQUMsQ0FDekIsQ0FBQztJQUVGLHFDQUFxQztJQUNyQyxxQ0FBcUM7SUFDckMsZ0VBQWdFO0lBQ2hFLElBQUk7SUFFSixtQ0FBbUM7SUFDbkMscUhBQXFIO0lBQ3JILDBFQUEwRTtJQUUxRSw0QkFBNEI7SUFDNUIsc0VBQXNFO0lBQ3RFLG1DQUFtQztJQUNuQyxvQ0FBb0M7SUFDcEMsS0FBSztJQUVMLGdDQUFnQztJQUNoQyxNQUFNLHFCQUFxQixHQUFHLGVBQWUsQ0FDM0MsYUFBYSxDQUFDLFlBQVksRUFDMUIsYUFBYSxDQUFDLGtCQUFrQixDQUNqQyxDQUFDO0lBRUYsTUFBTSxhQUFhLEdBQUcsTUFBTSxNQUFNLENBQUMsU0FBUyxFQUFFLElBQUksVUFBVSxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUM7SUFFL0UseUJBQXlCO0lBQ3pCLE1BQU0sY0FBYyxHQUFHLElBQUksY0FBYyxDQUN2QyxhQUFhLENBQUMsVUFBVSxFQUN4QixJQUFJLFVBQVUsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMscUJBQXFCLENBQUMsQ0FBQyxFQUMzRCxJQUFJLFVBQVUsQ0FBQyxlQUFlLENBQUMsQ0FDaEMsQ0FBQztJQUVGLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLEVBQUU7UUFDL0IsTUFBTSxJQUFJLEtBQUssQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO0tBQzdDO0lBQ0Qsa0JBQWtCO0lBQ2xCLE1BQU0sbUJBQW1CLEdBQUcsTUFBTSxlQUFlLENBQUMsZ0JBQWdCLENBQUMsU0FBUyxDQUFDLENBQUM7SUFFOUUsTUFBTSxNQUFNLEdBQUcsSUFBSSxNQUFNLENBQ3ZCLGFBQWEsQ0FBQyxrQkFBa0IsRUFDaEMsa0JBQWtCLEVBQ2xCLGFBQWEsQ0FBQyxZQUFZLEVBQzFCLGFBQWEsQ0FBQyxrQkFBa0IsRUFDaEMsYUFBYSxDQUFDLFNBQVMsRUFDdkIsYUFBYSxDQUFDLGtCQUFrQixFQUNoQyxhQUFhLENBQUMsZUFBZSxFQUM3QixjQUFjLEVBQ2QsSUFBSSxVQUFVLENBQUMsbUJBQW1CLENBQUMsQ0FDcEMsQ0FBQztJQUVGLHNCQUFzQjtJQUN0QixJQUFJLGVBQWUsQ0FBQztJQUNwQixJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsRUFBRTtRQUM1QixlQUFlLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7S0FDbEQ7U0FBTTtRQUNMLGVBQWUsR0FBRyxJQUFJLENBQUM7S0FDeEI7SUFFRCxNQUFNLGdCQUFnQixHQUFHLE1BQU0sYUFBYSxDQUMxQyxZQUFZLEVBQ1osSUFBSSxVQUFVLENBQUMsZUFBZSxDQUFDLEVBQy9CLEVBQUUsRUFDRixvQkFBb0IsR0FBRyxDQUFDLENBQ3pCLENBQUM7SUFFRixpQkFBaUI7SUFDakIsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQ3pCLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFDWixJQUFJLFVBQVUsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsb0JBQW9CLENBQUMsQ0FBQyxFQUNoRSxJQUFJLFVBQVUsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLENBQzlELENBQUM7SUFFRixvQkFBb0I7SUFDcEIsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzdDLE9BQU8sT0FBTyxDQUFDLFFBQVEsRUFBRSxDQUFDO0FBQzVCLENBQUMifQ==