/**
 * Database-backed Audit Log Store
 *
 * Provides persistent storage for security audit events using Drizzle ORM
 * with PostgreSQL. Addresses the security audit finding that in-memory
 * audit logs in secrets-rotation.ts are not persisted.
 *
 * Features:
 * - Full CRUD operations with proper indexing
 * - Query support with flexible filtering
 * - Request ID correlation for tracing
 * - Retention management with soft delete
 * - Both database and in-memory implementations
 * - Factory function for environment-based selection
 *
 * @packageDocumentation
 * @module audit/db-store
 */
import { type Database } from '../common/db.js';
import type { ID, Timestamp } from '../common/types.js';
import type { SecurityEventCategory, SecuritySeverity, SecurityOutcome, SecurityEventType } from './security-events.js';
/**
 * Audit entry for database storage
 *
 * This interface represents a security audit event that can be persisted
 * to the database. It's designed to capture all relevant security context
 * for SOC 2 compliance and forensic analysis.
 */
export interface AuditEntry {
    /** Unique identifier for the audit entry */
    id: string;
    /** Timestamp when the event occurred */
    timestamp: Timestamp;
    /** Type of security event */
    eventType: SecurityEventType | string;
    /** Event category (authentication, authorization, etc.) */
    category: SecurityEventCategory | string;
    /** Event severity level */
    severity: SecuritySeverity;
    /** ID of the actor performing the action */
    actorId: string;
    /** Type of actor (user, agent, service, system) */
    actorType: 'user' | 'agent' | 'service' | 'system';
    /** Display name of the actor */
    actorName?: string;
    /** IP address of the actor */
    actorIp?: string;
    /** Action performed */
    action: string;
    /** Type of resource affected */
    resourceType: string;
    /** ID of the resource affected */
    resourceId: string;
    /** Name of the resource */
    resourceName?: string;
    /** Outcome of the action */
    outcome: SecurityOutcome;
    /** Reason for the outcome (especially for failures/blocks) */
    reason?: string;
    /** Tenant ID for multi-tenant isolation */
    tenantId: ID;
    /** Request ID for correlation */
    requestId?: ID;
    /** Trace ID for distributed tracing */
    traceId?: string;
    /** Additional metadata */
    metadata?: Record<string, unknown>;
}
/**
 * Filter options for querying audit entries
 */
export interface AuditQueryFilter {
    /** Filter by tenant ID (required for multi-tenant isolation) */
    tenantId?: ID;
    /** Filter by event type */
    eventType?: SecurityEventType | string;
    /** Filter by category */
    category?: SecurityEventCategory | string;
    /** Filter by severity */
    severity?: SecuritySeverity;
    /** Filter by actor ID */
    actorId?: string;
    /** Filter by actor type */
    actorType?: 'user' | 'agent' | 'service' | 'system';
    /** Filter by resource type */
    resourceType?: string;
    /** Filter by resource ID */
    resourceId?: string;
    /** Filter by outcome */
    outcome?: SecurityOutcome;
    /** Filter by request ID */
    requestId?: ID;
    /** Start time for time range filter */
    startTime?: Timestamp;
    /** End time for time range filter */
    endTime?: Timestamp;
    /** Maximum number of results */
    limit?: number;
    /** Offset for pagination */
    offset?: number;
    /** Sort order */
    orderDirection?: 'asc' | 'desc';
}
/**
 * Interface for audit log storage implementations
 *
 * This interface defines the contract for audit log storage backends.
 * Implementations can use databases, in-memory storage, or other backends.
 */
export interface AuditLogStore {
    /**
     * Log an audit entry
     *
     * @param entry - The audit entry to log
     * @returns Promise that resolves when the entry is logged
     */
    log(entry: AuditEntry): Promise<void>;
    /**
     * Query audit entries with filters
     *
     * @param filter - Query filters
     * @returns Promise resolving to matching audit entries
     */
    query(filter: AuditQueryFilter): Promise<AuditEntry[]>;
    /**
     * Get all audit entries for a specific request
     *
     * @param requestId - The request ID to search for
     * @returns Promise resolving to all entries with the given request ID
     */
    getByRequestId(requestId: string): Promise<AuditEntry[]>;
    /**
     * Delete entries older than the specified date
     *
     * @param olderThan - Delete entries older than this date
     * @returns Promise resolving to the number of deleted entries
     */
    retention(olderThan: Date): Promise<number>;
}
/**
 * Audit severity enum for database
 */
export declare const auditEntrySeverityEnum: import("drizzle-orm/pg-core").PgEnum<["info", "low", "medium", "high", "critical"]>;
/**
 * Audit outcome enum for database
 */
export declare const auditEntryOutcomeEnum: import("drizzle-orm/pg-core").PgEnum<["success", "failure", "blocked", "escalated"]>;
/**
 * Audit entries table schema
 *
 * Stores security audit events with comprehensive indexing
 * for efficient querying and compliance reporting.
 */
export declare const auditEntries: import("drizzle-orm/pg-core").PgTableWithColumns<{
    name: "audit_entries";
    schema: undefined;
    columns: {
        id: import("drizzle-orm/pg-core").PgColumn<{
            name: "id";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgUUID";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: true;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        timestamp: import("drizzle-orm/pg-core").PgColumn<{
            name: "timestamp";
            tableName: "audit_entries";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        createdAt: import("drizzle-orm/pg-core").PgColumn<{
            name: "created_at";
            tableName: "audit_entries";
            dataType: "date";
            columnType: "PgTimestamp";
            data: Date;
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        eventType: import("drizzle-orm/pg-core").PgColumn<{
            name: "event_type";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        category: import("drizzle-orm/pg-core").PgColumn<{
            name: "category";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        severity: import("drizzle-orm/pg-core").PgColumn<{
            name: "severity";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgEnumColumn";
            data: "info" | "critical" | "low" | "medium" | "high";
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: ["info", "low", "medium", "high", "critical"];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        actorId: import("drizzle-orm/pg-core").PgColumn<{
            name: "actor_id";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        actorType: import("drizzle-orm/pg-core").PgColumn<{
            name: "actor_type";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        actorName: import("drizzle-orm/pg-core").PgColumn<{
            name: "actor_name";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        actorIp: import("drizzle-orm/pg-core").PgColumn<{
            name: "actor_ip";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        action: import("drizzle-orm/pg-core").PgColumn<{
            name: "action";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        resourceType: import("drizzle-orm/pg-core").PgColumn<{
            name: "resource_type";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        resourceId: import("drizzle-orm/pg-core").PgColumn<{
            name: "resource_id";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        resourceName: import("drizzle-orm/pg-core").PgColumn<{
            name: "resource_name";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        outcome: import("drizzle-orm/pg-core").PgColumn<{
            name: "outcome";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgEnumColumn";
            data: "escalated" | "success" | "failure" | "blocked";
            driverParam: string;
            notNull: true;
            hasDefault: true;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: ["success", "failure", "blocked", "escalated"];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        reason: import("drizzle-orm/pg-core").PgColumn<{
            name: "reason";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        tenantId: import("drizzle-orm/pg-core").PgColumn<{
            name: "tenant_id";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: true;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        requestId: import("drizzle-orm/pg-core").PgColumn<{
            name: "request_id";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        traceId: import("drizzle-orm/pg-core").PgColumn<{
            name: "trace_id";
            tableName: "audit_entries";
            dataType: "string";
            columnType: "PgText";
            data: string;
            driverParam: string;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: [string, ...string[]];
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {}>;
        metadata: import("drizzle-orm/pg-core").PgColumn<{
            name: "metadata";
            tableName: "audit_entries";
            dataType: "json";
            columnType: "PgJsonb";
            data: Record<string, unknown>;
            driverParam: unknown;
            notNull: false;
            hasDefault: false;
            isPrimaryKey: false;
            isAutoincrement: false;
            hasRuntimeDefault: false;
            enumValues: undefined;
            baseColumn: never;
            identity: undefined;
            generated: undefined;
        }, {}, {
            $type: Record<string, unknown>;
        }>;
    };
    dialect: "pg";
}>;
export type AuditEntryRecord = typeof auditEntries.$inferSelect;
export type NewAuditEntryRecord = typeof auditEntries.$inferInsert;
/**
 * Database-backed audit log store implementation
 *
 * Uses PostgreSQL via Drizzle ORM for persistent storage of audit events.
 * Provides comprehensive querying capabilities for compliance reporting
 * and forensic analysis.
 */
export declare class DatabaseAuditStore implements AuditLogStore {
    private db;
    /**
     * Create a new DatabaseAuditStore
     *
     * @param options - Configuration options
     */
    constructor(options?: {
        database?: Database;
    });
    /**
     * Log an audit entry to the database
     */
    log(entry: AuditEntry): Promise<void>;
    /**
     * Query audit entries with filters
     */
    query(filter: AuditQueryFilter): Promise<AuditEntry[]>;
    /**
     * Get all audit entries for a specific request ID
     */
    getByRequestId(requestId: string): Promise<AuditEntry[]>;
    /**
     * Delete entries older than the specified date
     *
     * This is used for retention management. Entries older than the
     * specified date are permanently deleted.
     */
    retention(olderThan: Date): Promise<number>;
    /**
     * Get statistics about audit entries
     */
    getStats(tenantId?: ID): Promise<{
        totalEntries: number;
        byCategory: Record<string, number>;
        bySeverity: Record<string, number>;
        byOutcome: Record<string, number>;
    }>;
    /**
     * Map a database record to an AuditEntry
     */
    private mapRecordToEntry;
}
/**
 * In-memory audit log store for testing
 *
 * Stores audit entries in memory. Useful for unit tests and development.
 * Not suitable for production use as data is lost on restart.
 */
export declare class InMemoryAuditStore implements AuditLogStore {
    private entries;
    private maxEntries;
    /**
     * Create a new InMemoryAuditStore
     *
     * @param options - Configuration options
     */
    constructor(options?: {
        maxEntries?: number;
    });
    /**
     * Log an audit entry to memory
     */
    log(entry: AuditEntry): Promise<void>;
    /**
     * Query audit entries with filters
     */
    query(filter: AuditQueryFilter): Promise<AuditEntry[]>;
    /**
     * Get all audit entries for a specific request ID
     */
    getByRequestId(requestId: string): Promise<AuditEntry[]>;
    /**
     * Delete entries older than the specified date
     */
    retention(olderThan: Date): Promise<number>;
    /**
     * Clear all entries (for testing)
     */
    clear(): void;
    /**
     * Get all entries (for testing)
     */
    getAll(): AuditEntry[];
    /**
     * Get entry count
     */
    get count(): number;
}
/**
 * Store type for factory function
 */
export type AuditStoreType = 'database' | 'memory';
/**
 * Options for creating an audit store
 */
export interface CreateAuditStoreOptions {
    /** Type of store to create (auto-detected from environment if not specified) */
    type?: AuditStoreType;
    /** Database instance (for database store) */
    database?: Database;
    /** Maximum entries for in-memory store */
    maxEntries?: number;
}
/**
 * Create an audit log store based on environment configuration
 *
 * This factory function creates the appropriate audit store based on
 * the current environment. In production/staging, it uses the database
 * store. In development/test, it can use either based on configuration.
 *
 * @param options - Store configuration options
 * @returns An AuditLogStore implementation
 *
 * @example
 * ```typescript
 * // Auto-detect based on environment
 * const store = createAuditStore();
 *
 * // Force database store
 * const dbStore = createAuditStore({ type: 'database' });
 *
 * // Force in-memory store (for testing)
 * const memStore = createAuditStore({ type: 'memory' });
 * ```
 */
export declare function createAuditStore(options?: CreateAuditStoreOptions): AuditLogStore;
/**
 * Get the singleton audit store instance
 *
 * @param options - Store configuration options (only used on first call)
 * @returns The singleton AuditLogStore instance
 */
export declare function getAuditStore(options?: CreateAuditStoreOptions): AuditLogStore;
/**
 * Reset the singleton audit store (for testing)
 */
export declare function resetAuditStore(): void;
/**
 * Create an audit entry with a new UUID
 *
 * @param data - Partial audit entry data
 * @returns Complete AuditEntry with generated ID and timestamp
 */
export declare function createAuditEntry(data: Omit<AuditEntry, 'id' | 'timestamp'> & {
    timestamp?: Timestamp;
}): AuditEntry;
/**
 * Helper to log a security event to the audit store
 *
 * @param store - The audit store to use
 * @param event - Event details
 * @returns Promise resolving when the event is logged
 */
export declare function logSecurityEvent(store: AuditLogStore, event: {
    eventType: SecurityEventType | string;
    category: SecurityEventCategory | string;
    severity: SecuritySeverity;
    actor: {
        id: string;
        type: 'user' | 'agent' | 'service' | 'system';
        name?: string;
        ip?: string;
    };
    action: string;
    resource: {
        type: string;
        id: string;
        name?: string;
    };
    outcome: SecurityOutcome;
    reason?: string;
    tenantId: ID;
    requestId?: ID;
    traceId?: string;
    metadata?: Record<string, unknown>;
}): Promise<void>;
//# sourceMappingURL=db-store.d.ts.map