import type { FieldEncryptionService } from './service.js';
import type { FieldEncryptionPolicy } from './types.js';
/**
 * Table encryption policy configuration
 */
export interface TablePolicy {
    /** Table/entity name */
    tableName: string;
    /** Encryption policy for the table */
    policy: FieldEncryptionPolicy;
    /** Whether to fail on encryption errors (default: true) */
    failOnError?: boolean;
    /** Whether decryption is required or optional */
    requireDecryption?: boolean;
}
/**
 * Middleware configuration options
 */
export interface EncryptionMiddlewareConfig {
    /** Map of table names to encryption policies */
    policies: Record<string, FieldEncryptionPolicy>;
    /** Custom encryption service (uses default if not provided) */
    encryptionService?: FieldEncryptionService;
    /** Default tenant ID for multi-tenant setups */
    defaultTenantId?: string;
    /** Function to extract tenant ID from context */
    getTenantId?: (context: unknown) => string | undefined;
    /** Whether to fail on encryption errors (default: true) */
    failOnError?: boolean;
    /** Enable debug logging */
    debug?: boolean;
}
/**
 * Operation context for middleware hooks
 */
export interface OperationContext {
    /** Table/entity name */
    tableName: string;
    /** Operation type */
    operation: 'insert' | 'update' | 'select' | 'delete';
    /** Tenant ID if multi-tenant */
    tenantId?: string;
    /** Request ID for tracing */
    requestId?: string;
    /** User ID performing the operation */
    userId?: string;
}
/**
 * Middleware hook result
 */
export interface HookResult<T> {
    /** The processed data */
    data: T;
    /** Fields that were encrypted/decrypted */
    processedFields: string[];
    /** Any errors that occurred (if not failing on error) */
    errors?: Array<{
        field: string;
        error: string;
    }>;
}
/**
 * Database encryption middleware
 *
 * Provides hooks for automatic field-level encryption and decryption
 * during database operations.
 */
export declare class EncryptionMiddleware {
    private readonly config;
    private readonly encryptionService;
    private initialized;
    constructor(config: EncryptionMiddlewareConfig);
    /**
     * Initialize the middleware
     */
    initialize(): Promise<void>;
    /**
     * Ensure middleware is initialized
     */
    private ensureInitialized;
    /**
     * Get policy for a table
     */
    private getPolicy;
    /**
     * Extract tenant ID from context
     */
    private extractTenantId;
    /**
     * Pre-insert hook - encrypts fields before insert
     *
     * @param data - The data to be inserted
     * @param context - Operation context
     * @returns Processed data with encrypted fields
     */
    beforeInsert<T extends Record<string, unknown>>(data: T, context: OperationContext): Promise<HookResult<T>>;
    /**
     * Pre-update hook - encrypts fields before update
     *
     * @param data - The data to be updated
     * @param context - Operation context
     * @returns Processed data with encrypted fields
     */
    beforeUpdate<T extends Record<string, unknown>>(data: T, context: OperationContext): Promise<HookResult<T>>;
    /**
     * Post-select hook - decrypts fields after select
     *
     * @param data - The data retrieved from database
     * @param context - Operation context
     * @returns Processed data with decrypted fields
     */
    afterSelect<T extends Record<string, unknown>>(data: T, context: OperationContext): Promise<HookResult<T>>;
    /**
     * Batch pre-insert hook - encrypts fields for multiple records
     */
    beforeInsertMany<T extends Record<string, unknown>>(records: T[], context: OperationContext): Promise<HookResult<T[]>>;
    /**
     * Batch post-select hook - decrypts fields for multiple records
     */
    afterSelectMany<T extends Record<string, unknown>>(records: T[], context: OperationContext): Promise<HookResult<T[]>>;
    /**
     * Encrypt data according to policy
     */
    private encryptData;
    /**
     * Decrypt data according to policy
     */
    private decryptData;
    /**
     * Get nested value from object using dot notation
     */
    private getNestedValue;
    /**
     * Set nested value in object using dot notation
     */
    private setNestedValue;
    /**
     * Create Drizzle ORM compatible configuration
     *
     * Returns configuration hooks that can be passed to Drizzle.
     */
    getDrizzleConfig(): DrizzleEncryptionConfig;
    /**
     * Shutdown the middleware
     */
    shutdown(): Promise<void>;
}
/**
 * Drizzle ORM encryption configuration
 */
export interface DrizzleEncryptionConfig {
    beforeInsert: <T extends Record<string, unknown>>(data: T, context: OperationContext) => Promise<HookResult<T>>;
    beforeUpdate: <T extends Record<string, unknown>>(data: T, context: OperationContext) => Promise<HookResult<T>>;
    afterSelect: <T extends Record<string, unknown>>(data: T, context: OperationContext) => Promise<HookResult<T>>;
    beforeInsertMany: <T extends Record<string, unknown>>(records: T[], context: OperationContext) => Promise<HookResult<T[]>>;
    afterSelectMany: <T extends Record<string, unknown>>(records: T[], context: OperationContext) => Promise<HookResult<T[]>>;
}
/**
 * Create encryption middleware instance
 */
export declare function createEncryptionMiddleware(config: EncryptionMiddlewareConfig): EncryptionMiddleware;
/**
 * Create middleware from decorated classes
 *
 * Automatically generates policies from class decorators.
 *
 * @example
 * ```typescript
 * const middleware = createMiddlewareFromClasses({
 *   User: UserEntity,
 *   Patient: PatientEntity,
 * });
 * ```
 */
export declare function createMiddlewareFromClasses(classMap: Record<string, new (...args: unknown[]) => unknown>, options?: Omit<EncryptionMiddlewareConfig, 'policies'>): EncryptionMiddleware;
/**
 * Get the default encryption middleware instance
 */
export declare function getEncryptionMiddleware(): EncryptionMiddleware | null;
/**
 * Set the default encryption middleware instance
 */
export declare function setEncryptionMiddleware(middleware: EncryptionMiddleware): void;
/**
 * Reset the default encryption middleware (for testing)
 */
export declare function resetEncryptionMiddleware(): Promise<void>;
/**
 * Create a policy builder for fluent policy creation
 *
 * @example
 * ```typescript
 * const policy = policyBuilder('users')
 *   .addField('ssn', DataClassification.RESTRICTED)
 *   .addSearchableField('email', DataClassification.CONFIDENTIAL)
 *   .addField('phone', DataClassification.CONFIDENTIAL, { algorithm: 'chacha20-poly1305' })
 *   .build();
 * ```
 */
export declare function policyBuilder(entityName: string): PolicyBuilder;
/**
 * Fluent policy builder
 */
export declare class PolicyBuilder {
    private readonly entityName;
    private readonly fields;
    private description?;
    private defaultClassification?;
    private strictMode;
    constructor(entityName: string);
    /**
     * Add a field to the policy
     */
    addField(fieldName: string, classification: import('./types.js').DataClassification, options?: {
        algorithm?: import('./types.js').EncryptionAlgorithm;
        keyDerivationSuffix?: string;
    }): this;
    /**
     * Add a searchable (deterministic) encrypted field
     */
    addSearchableField(fieldName: string, classification: import('./types.js').DataClassification, options?: {
        keyDerivationSuffix?: string;
    }): this;
    /**
     * Add a non-encrypted field (for documentation)
     */
    addUnencryptedField(fieldName: string, classification: import('./types.js').DataClassification): this;
    /**
     * Set policy description
     */
    withDescription(description: string): this;
    /**
     * Set default classification for unlisted fields
     */
    withDefaultClassification(classification: import('./types.js').DataClassification): this;
    /**
     * Enable strict mode (fail on unlisted fields)
     */
    withStrictMode(strict?: boolean): this;
    /**
     * Build the policy
     */
    build(): FieldEncryptionPolicy;
}
//# sourceMappingURL=middleware.d.ts.map