"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.assertCompliantIdentity = assertCompliantIdentity;
exports.isCompliantAsymmetricEncryptionType = isCompliantAsymmetricEncryptionType;
exports.isCompliantEncryptionType = isCompliantEncryptionType;
exports.isCompliantSignatureType = isCompliantSignatureType;
exports.createCompliantExchangeKeys = createCompliantExchangeKeys;
const trackerless_network_1 = require("@streamr/trackerless-network");
const RSAKeyPair_1 = require("../encryption/RSAKeyPair");
const MLKEMKeyPair_1 = require("../encryption/MLKEMKeyPair");
const StreamrClientError_1 = require("../StreamrClientError");
const quantumResistantSignatureTypes = new Set([trackerless_network_1.SignatureType.ML_DSA_87]);
const quantumResistantAsymmetricEncryptionTypes = new Set([trackerless_network_1.AsymmetricEncryptionType.ML_KEM]);
const quantumResistantEncryptionTypes = new Set([trackerless_network_1.EncryptionType.AES]);
function assertCompliantIdentity(identity, config) {
    const isQuantumResistant = isQuantumResistantIdentity(identity);
    const quantumResistanceIsRequired = config.encryption?.requireQuantumResistantSignatures;
    if (quantumResistanceIsRequired && !isQuantumResistant) {
        throw new StreamrClientError_1.StreamrClientError(`Quantum resistant signatures are required, but the configured key type doesn't enable quantum resistance!`, 'SIGNATURE_POLICY_VIOLATION');
    }
}
function isCompliantAsymmetricEncryptionType(encryptionType, config) {
    const isQuantumResistant = quantumResistantAsymmetricEncryptionTypes.has(encryptionType);
    const quantumResistanceIsRequired = config.encryption?.requireQuantumResistantKeyExchange;
    return isQuantumResistant || !quantumResistanceIsRequired;
}
function isCompliantEncryptionType(encryptionType, config) {
    const isQuantumResistant = quantumResistantEncryptionTypes.has(encryptionType);
    const quantumResistanceIsRequired = config.encryption?.requireQuantumResistantEncryption;
    return isQuantumResistant || !quantumResistanceIsRequired;
}
function isCompliantSignatureType(signatureType, config) {
    const isQuantumResistant = quantumResistantSignatureTypes.has(signatureType);
    const quantumResistanceIsRequired = config.encryption?.requireQuantumResistantSignatures;
    return isQuantumResistant || !quantumResistanceIsRequired;
}
function isQuantumResistantIdentity(identity) {
    return quantumResistantSignatureTypes.has(identity.getSignatureType());
}
/**
 * Creates a suitable key pair for key exchange based in configured Identity and config.
 * Uses ML-KEM if required by config, OR if the identity keys imply quantum secure signatures.
 */
async function createCompliantExchangeKeys(identity, config) {
    if (config.encryption.requireQuantumResistantKeyExchange || isQuantumResistantIdentity(identity)) {
        return MLKEMKeyPair_1.MLKEMKeyPair.create();
    }
    else {
        return RSAKeyPair_1.RSAKeyPair.create(config.encryption.rsaKeyLength);
    }
}
//# sourceMappingURL=encryptionCompliance.js.map