// tools/challenge-spec/privacy-challenge-scenarios.ts — Privacy challenges (SPEC-030)
// Generates privacy-specific failure scenarios when a spec involves PII.
import { detectPIIInSpec } from '../../engine/pii-detector.js';
/**
 * Generates privacy challenge scenarios for specs that collect or process PII.
 * These challenges are MANDATORY (cannot be skipped) per SPEC-030 business rules.
 *
 * Questions covered:
 * - "What is the legal basis for processing this data?"
 * - "What happens if the user withdraws consent while data is being processed?"
 */
export function generatePrivacyChallengeScenarios(spec, specContent, _knowledge) {
    const result = detectPIIInSpec(spec.title, specContent, specContent);
    if (!result.hasPII) {
        return [];
    }
    const scenarios = [];
    // Challenge 1: Legal basis for processing
    scenarios.push({
        scenario: `[${spec.id}] Privacy — Legal Basis: What is the legal basis for processing the personal data detected in this spec (${result.fields.map((f) => f.fieldName).join(', ')})? Has a balancing test been conducted if using "legitimate interest"?`,
        probability: 'high',
        impact: 'critical',
        currentHandling: 'Legal basis may not be documented in the spec — processing data without a documented legal basis is a GDPR violation.',
        requiredHandling: 'Document the legal basis for each personal data field: consent, contract, legal-obligation, vital-interest, public-task, or legitimate-interest. ' +
            'For sensitive-special categories (GDPR Art. 9), only consent or legal-obligation are valid. ' +
            'Add this to the spec privacy section before implementation.',
        dataConsistency: 'If legal basis changes (e.g. user withdraws consent), the data may no longer be lawfully processed and must be deleted.',
        userExperience: 'Users must be informed of the legal basis at point of collection. Provide a clear privacy notice.',
    });
    // Challenge 2: Consent withdrawal during active processing
    if (result.requiresConsentFlow) {
        scenarios.push({
            scenario: `[${spec.id}] Privacy — Consent Withdrawal: What happens if the user withdraws consent while their data is actively being processed (e.g., mid-batch-job, mid-transaction, or stored in an async queue)?`,
            probability: 'medium',
            impact: 'high',
            currentHandling: 'Async processing pipelines may not check consent status at each processing step — consent withdrawal may not halt in-flight operations.',
            requiredHandling: 'Implement consent-check gates in async processing pipelines. ' +
                'When consent is withdrawn: (1) stop all processing immediately, (2) delete or anonymize the data, ' +
                '(3) propagate deletion to all systems (DB, cache, queues, third parties), ' +
                '(4) confirm deletion to the user. Retention must be triggered even for in-flight operations.',
            dataConsistency: 'Consent withdrawal must be propagated consistently across all data stores. Consider distributed transaction patterns or saga compensation.',
            userExperience: 'User should receive confirmation that their data has been deleted within a reasonable timeframe (typically 30 days under GDPR).',
        });
    }
    // Challenge 3: Right to erasure — propagation
    if (result.requiresRightToErasure) {
        scenarios.push({
            scenario: `[${spec.id}] Privacy — Right to Erasure Propagation: When a user requests deletion of their personal data, are ALL systems updated? Does deletion propagate to backups, logs, caches, and third-party processors?`,
            probability: 'high',
            impact: 'high',
            currentHandling: 'Deletion may only be implemented in the primary database — backups, logs, and third-party systems may retain copies.',
            requiredHandling: 'Define a complete erasure plan: (1) primary DB soft/hard delete, (2) backup retention schedule respects erasure requests, ' +
                '(3) logs are scrubbed or have a TTL policy, (4) third-party processors are notified via API or manual DPA process, ' +
                '(5) a verification step confirms deletion is complete.',
            dataConsistency: 'Audit trail of erasure requests must be retained (without the personal data itself) to prove compliance.',
            userExperience: 'User should receive a deletion confirmation with a reference ID within 72 hours of request.',
        });
    }
    // Challenge 4: Sensitive special categories
    if (result.sensitiveSpecialCount > 0) {
        scenarios.push({
            scenario: `[${spec.id}] Privacy — Special Category Data (GDPR Art. 9): This spec processes ${result.sensitiveSpecialCount} special-category field(s). Special categories cannot use "legitimate interest" as legal basis. Has additional explicit consent been obtained?`,
            probability: 'high',
            impact: 'critical',
            currentHandling: 'Special category data (health, race, religion, biometric, political opinion, sexual orientation) requires explicit consent — implied consent or generic privacy policies are insufficient.',
            requiredHandling: 'For each special-category field: (1) obtain explicit, granular consent specifically for that data type, ' +
                '(2) document the justification for necessity, (3) implement extra encryption and access controls, ' +
                '(4) restrict access to only personnel who require it.',
            dataConsistency: 'Special-category data must be segregated from other PII and have stricter access audit trails.',
            userExperience: 'Consent UI must clearly describe what special-category data is collected and why — vague descriptions are not valid consent.',
        });
    }
    return scenarios;
}
//# sourceMappingURL=privacy-challenge-scenarios.js.map