/**
 * API Key Management Type Definitions
 *
 * Defines types, interfaces, and Zod schemas for API key management
 * including creation, validation, scopes, and rate limiting.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
// =============================================================================
// API KEY SCOPES
// =============================================================================
/**
 * API key scopes defining access levels
 */
export const ApiKeyScope = {
    /** Read-only access to resources */
    READ: 'read',
    /** Write access (create, update, delete) */
    WRITE: 'write',
    /** Administrative operations */
    ADMIN: 'admin',
    /** Webhook management */
    WEBHOOK: 'webhook',
    /** Integration access (external systems) */
    INTEGRATION: 'integration',
};
export const apiKeyScopeSchema = z.nativeEnum(ApiKeyScope);
export const API_KEY_SCOPES = Object.values(ApiKeyScope);
// =============================================================================
// API KEY STATUS
// =============================================================================
/**
 * API key status
 */
export const ApiKeyStatus = {
    /** Key is active and can be used */
    ACTIVE: 'active',
    /** Key is revoked and cannot be used */
    REVOKED: 'revoked',
    /** Key has expired */
    EXPIRED: 'expired',
};
export const apiKeyStatusSchema = z.nativeEnum(ApiKeyStatus);
export const apiKeyRateLimitSchema = z.object({
    requestsPerMinute: z.number().int().positive().default(60),
    requestsPerHour: z.number().int().positive().default(1000),
    burstLimit: z.number().int().positive().default(10),
});
/**
 * Default rate limits for API keys
 */
export const DEFAULT_API_KEY_RATE_LIMIT = {
    requestsPerMinute: 60,
    requestsPerHour: 1000,
    burstLimit: 10,
};
export const apiKeySchema = z.object({
    id: z.string().uuid(),
    name: z.string().min(1).max(255),
    hashedKey: z.string().min(1),
    prefix: z.string().length(8),
    tenantId: z.string().min(1),
    scopes: z.array(apiKeyScopeSchema).min(1),
    rateLimit: apiKeyRateLimitSchema,
    status: apiKeyStatusSchema,
    expiresAt: z.date().nullable(),
    createdAt: z.date(),
    lastUsedAt: z.date().nullable(),
    metadata: z.record(z.unknown()),
    createdBy: z.string().min(1),
    description: z.string().max(1000).optional(),
    allowedIps: z.array(z.string().ip()).optional(),
});
export const createApiKeyInputSchema = z.object({
    name: z.string().min(1).max(255),
    tenantId: z.string().min(1),
    scopes: z.array(apiKeyScopeSchema).min(1),
    rateLimit: apiKeyRateLimitSchema.partial().optional(),
    expiresInDays: z.number().int().positive().nullable().optional(),
    metadata: z.record(z.unknown()).optional(),
    createdBy: z.string().min(1),
    description: z.string().max(1000).optional(),
    allowedIps: z.array(z.string().ip()).optional(),
});
export const updateApiKeyInputSchema = z.object({
    name: z.string().min(1).max(255).optional(),
    scopes: z.array(apiKeyScopeSchema).min(1).optional(),
    rateLimit: apiKeyRateLimitSchema.partial().optional(),
    metadata: z.record(z.unknown()).optional(),
    description: z.string().max(1000).optional(),
    allowedIps: z.array(z.string().ip()).optional(),
    status: apiKeyStatusSchema.optional(),
});
/**
 * Validation error codes
 */
export const ApiKeyValidationErrorCode = {
    /** Key not found */
    NOT_FOUND: 'NOT_FOUND',
    /** Key has been revoked */
    REVOKED: 'REVOKED',
    /** Key has expired */
    EXPIRED: 'EXPIRED',
    /** Invalid key format */
    INVALID_FORMAT: 'INVALID_FORMAT',
    /** Key hash mismatch */
    HASH_MISMATCH: 'HASH_MISMATCH',
    /** IP not in whitelist */
    IP_NOT_ALLOWED: 'IP_NOT_ALLOWED',
    /** Insufficient scope */
    INSUFFICIENT_SCOPE: 'INSUFFICIENT_SCOPE',
    /** Rate limit exceeded */
    RATE_LIMITED: 'RATE_LIMITED',
};
export const apiKeyValidationResultSchema = z.object({
    valid: z.boolean(),
    apiKey: apiKeySchema.optional(),
    error: z.string().optional(),
    errorCode: z.nativeEnum(ApiKeyValidationErrorCode).optional(),
});
export const apiKeyListFiltersSchema = z.object({
    tenantId: z.string().min(1),
    status: apiKeyStatusSchema.optional(),
    scope: apiKeyScopeSchema.optional(),
    createdBy: z.string().optional(),
    limit: z.number().int().min(1).max(100).default(50),
    offset: z.number().int().min(0).default(0),
});
// =============================================================================
// API KEY AUDIT EVENT TYPES
// =============================================================================
/**
 * Audit event types for API key operations
 */
export const ApiKeyAuditEventType = {
    CREATED: 'api_key.created',
    UPDATED: 'api_key.updated',
    REVOKED: 'api_key.revoked',
    DELETED: 'api_key.deleted',
    VALIDATED: 'api_key.validated',
    VALIDATION_FAILED: 'api_key.validation_failed',
    RATE_LIMITED: 'api_key.rate_limited',
    ROTATED: 'api_key.rotated',
};
// =============================================================================
// KEY FORMAT
// =============================================================================
/**
 * API key format: vak_${prefix}_${secret}
 * - vak: Vorion API Key prefix
 * - prefix: 8 character identifier for lookup
 * - secret: 43 character base64url encoded random bytes
 */
export const API_KEY_PREFIX = 'vak';
export const API_KEY_PREFIX_LENGTH = 8;
export const API_KEY_SECRET_LENGTH = 43; // 32 bytes = 43 chars in base64url
/**
 * Regex pattern for validating API key format
 */
export const API_KEY_PATTERN = /^vak_[a-zA-Z0-9]{8}_[a-zA-Z0-9_-]{43}$/;
//# sourceMappingURL=types.js.map