/**
 * Field-Level Encryption Types
 *
 * Type definitions for transparent field-level encryption of sensitive data.
 * Provides interfaces for encrypting individual fields stored in the database
 * with support for:
 * - Multiple encryption algorithms (AES-256-GCM, AES-256-CBC, ChaCha20-Poly1305)
 * - Key versioning for rotation support
 * - Data classification levels
 * - Field-specific encryption policies
 * - Deterministic encryption for searchable fields
 *
 * @packageDocumentation
 * @module security/encryption/types
 */
import { z } from 'zod';
// =============================================================================
// Encryption Algorithm Types
// =============================================================================
/**
 * Supported encryption algorithms for field-level encryption
 *
 * - AES_256_GCM: Authenticated encryption with associated data (AEAD), recommended default
 * - AES_256_CBC: Block cipher mode, requires separate HMAC for authentication
 * - CHACHA20_POLY1305: Modern stream cipher with authentication, good performance
 */
export const EncryptionAlgorithm = {
    /** AES-256-GCM - Recommended default with built-in authentication */
    AES_256_GCM: 'aes-256-gcm',
    /** AES-256-CBC - Legacy mode, requires separate HMAC */
    AES_256_CBC: 'aes-256-cbc',
    /** ChaCha20-Poly1305 - Modern authenticated encryption */
    CHACHA20_POLY1305: 'chacha20-poly1305',
};
export const encryptionAlgorithmSchema = z.nativeEnum(EncryptionAlgorithm);
// =============================================================================
// Data Classification Types
// =============================================================================
/**
 * Data classification levels for determining encryption requirements
 *
 * Classification hierarchy (lowest to highest sensitivity):
 * - PUBLIC: No encryption required, publicly available data
 * - INTERNAL: Internal use only, encryption optional
 * - CONFIDENTIAL: Business-sensitive data, encryption required
 * - RESTRICTED: Highly sensitive data (PII, PHI, PCI), strongest encryption
 */
export const DataClassification = {
    /** Public data - no encryption required */
    PUBLIC: 'public',
    /** Internal data - encryption optional */
    INTERNAL: 'internal',
    /** Confidential business data - encryption required */
    CONFIDENTIAL: 'confidential',
    /** Restricted/regulated data (PII, PHI, PCI) - strongest encryption */
    RESTRICTED: 'restricted',
};
export const dataClassificationSchema = z.nativeEnum(DataClassification);
/**
 * Classification level ordering for comparison
 */
export const CLASSIFICATION_LEVELS = {
    [DataClassification.PUBLIC]: 0,
    [DataClassification.INTERNAL]: 1,
    [DataClassification.CONFIDENTIAL]: 2,
    [DataClassification.RESTRICTED]: 3,
};
export const encryptedFieldSchema = z.object({
    ciphertext: z.string().min(1),
    iv: z.string().min(1),
    authTag: z.string().min(1),
    algorithm: encryptionAlgorithmSchema,
    keyVersion: z.number().int().positive(),
    fieldName: z.string().optional(),
    encryptedAt: z.string().datetime().optional(),
    deterministic: z.boolean().optional(),
});
export const encryptedFieldMarkerSchema = z.object({
    __encrypted: z.literal(true),
    __version: z.literal(2),
    field: encryptedFieldSchema,
});
/**
 * Check if a value is an encrypted field marker
 */
export function isEncryptedFieldMarker(value) {
    return (typeof value === 'object' &&
        value !== null &&
        '__encrypted' in value &&
        value.__encrypted === true &&
        '__version' in value &&
        value.__version === 2 &&
        'field' in value);
}
export const keyVersionSchema = z.object({
    version: z.number().int().positive(),
    createdAt: z.coerce.date(),
    activatedAt: z.coerce.date().optional(),
    deprecatedAt: z.coerce.date().optional(),
    expiresAt: z.coerce.date().optional(),
    status: z.enum(['pending', 'active', 'deprecated', 'expired']),
});
export const encryptionConfigSchema = z.object({
    defaultAlgorithm: encryptionAlgorithmSchema.default(EncryptionAlgorithm.AES_256_GCM),
    enabled: z.boolean().default(true),
    keyDerivationInfo: z.string().default('vorion-field-encryption-v1'),
    hkdfHash: z.enum(['sha256', 'sha384', 'sha512']).default('sha256'),
    keyLength: z.number().int().positive().default(32),
    ivLength: z.number().int().positive().default(16),
    authTagLength: z.number().int().positive().default(16),
    includeFieldNameInAAD: z.boolean().default(true),
    includeTimestamp: z.boolean().default(true),
    redisKeyPrefix: z.string().default('vorion:encryption:'),
    auditLogging: z.boolean().default(true),
    minimumEncryptionLevel: dataClassificationSchema.default(DataClassification.CONFIDENTIAL),
});
/**
 * Default encryption configuration
 */
export const DEFAULT_ENCRYPTION_CONFIG = {
    defaultAlgorithm: EncryptionAlgorithm.AES_256_GCM,
    enabled: true,
    keyDerivationInfo: 'vorion-field-encryption-v1',
    hkdfHash: 'sha256',
    keyLength: 32,
    ivLength: 16,
    authTagLength: 16,
    includeFieldNameInAAD: true,
    includeTimestamp: true,
    redisKeyPrefix: 'vorion:encryption:',
    auditLogging: true,
    minimumEncryptionLevel: DataClassification.CONFIDENTIAL,
};
export const fieldPolicySchema = z.object({
    fieldName: z.string().min(1),
    classification: dataClassificationSchema,
    encrypted: z.boolean(),
    algorithm: encryptionAlgorithmSchema.optional(),
    deterministic: z.boolean().optional(),
    keyDerivationSuffix: z.string().optional(),
});
export const fieldEncryptionPolicySchema = z.object({
    entityName: z.string().min(1),
    description: z.string().optional(),
    fields: z.array(fieldPolicySchema),
    defaultClassification: dataClassificationSchema.optional(),
    strictMode: z.boolean().optional(),
});
export const encryptOptionsSchema = z.object({
    fieldName: z.string().optional(),
    classification: dataClassificationSchema.optional(),
    algorithm: encryptionAlgorithmSchema.optional(),
    keyVersion: z.number().int().positive().optional(),
    deterministic: z.boolean().optional(),
    additionalData: z.string().optional(),
    tenantId: z.string().optional(),
});
export const decryptOptionsSchema = z.object({
    fieldName: z.string().optional(),
    additionalData: z.string().optional(),
    tenantId: z.string().optional(),
});
export const reencryptOptionsSchema = z.object({
    newKeyVersion: z.number().int().positive(),
    newAlgorithm: encryptionAlgorithmSchema.optional(),
    fieldName: z.string().optional(),
    tenantId: z.string().optional(),
});
// =============================================================================
// Audit Types
// =============================================================================
/**
 * Encryption operation types for audit logging
 */
export const EncryptionOperation = {
    ENCRYPT: 'encrypt',
    DECRYPT: 'decrypt',
    REENCRYPT: 'reencrypt',
    KEY_ROTATE: 'key_rotate',
    KEY_DERIVE: 'key_derive',
};
export const encryptionAuditEntrySchema = z.object({
    id: z.string().uuid(),
    timestamp: z.coerce.date(),
    operation: z.nativeEnum(EncryptionOperation),
    fieldName: z.string().optional(),
    entityName: z.string().optional(),
    keyVersion: z.number().int().positive(),
    algorithm: encryptionAlgorithmSchema,
    success: z.boolean(),
    error: z.string().optional(),
    durationMs: z.number().nonnegative(),
    userId: z.string().optional(),
    tenantId: z.string().optional(),
    requestId: z.string().optional(),
});
// =============================================================================
// Error Types
// =============================================================================
/**
 * Error codes for encryption operations
 */
export const EncryptionErrorCode = {
    /** Invalid algorithm specified */
    INVALID_ALGORITHM: 'INVALID_ALGORITHM',
    /** Key version not found */
    KEY_VERSION_NOT_FOUND: 'KEY_VERSION_NOT_FOUND',
    /** Key derivation failed */
    KEY_DERIVATION_FAILED: 'KEY_DERIVATION_FAILED',
    /** Encryption failed */
    ENCRYPTION_FAILED: 'ENCRYPTION_FAILED',
    /** Decryption failed */
    DECRYPTION_FAILED: 'DECRYPTION_FAILED',
    /** Authentication tag verification failed */
    AUTH_TAG_MISMATCH: 'AUTH_TAG_MISMATCH',
    /** Field name mismatch in AAD */
    FIELD_NAME_MISMATCH: 'FIELD_NAME_MISMATCH',
    /** Invalid encrypted field format */
    INVALID_FORMAT: 'INVALID_FORMAT',
    /** Key provider not initialized */
    KEY_PROVIDER_NOT_INITIALIZED: 'KEY_PROVIDER_NOT_INITIALIZED',
    /** Re-encryption failed */
    REENCRYPT_FAILED: 'REENCRYPT_FAILED',
    /** Policy violation */
    POLICY_VIOLATION: 'POLICY_VIOLATION',
    /** Configuration error */
    CONFIG_ERROR: 'CONFIG_ERROR',
};
//# sourceMappingURL=types.js.map