"use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.KeyManagerService = void 0;
const db_1 = require("@n8n/db");
const di_1 = require("@n8n/di");
const n8n_core_1 = require("n8n-core");
const node_crypto_1 = require("node:crypto");
const not_found_error_1 = require("../../errors/response-errors/not-found.error");
let KeyManagerService = class KeyManagerService {
    constructor(deploymentKeyRepository, cipher) {
        this.deploymentKeyRepository = deploymentKeyRepository;
        this.cipher = cipher;
    }
    async getActiveKey() {
        const activeKeys = await this.deploymentKeyRepository.find({
            where: { type: 'data_encryption', status: 'active' },
        });
        if (activeKeys.length === 0) {
            throw new not_found_error_1.NotFoundError('No active encryption key found');
        }
        if (activeKeys.length > 1) {
            throw new Error('Encryption key invariant violated: multiple active keys found');
        }
        const key = activeKeys[0];
        return { id: key.id, value: key.value, algorithm: key.algorithm };
    }
    async getKeyById(id) {
        const key = await this.deploymentKeyRepository.findOne({ where: { id } });
        if (!key)
            return null;
        return { id: key.id, value: key.value, algorithm: key.algorithm };
    }
    async getLegacyKey() {
        const key = await this.deploymentKeyRepository.findOne({
            where: { type: 'data_encryption', algorithm: 'aes-256-cbc' },
        });
        if (!key) {
            throw new not_found_error_1.NotFoundError('No legacy aes-256-cbc encryption key found');
        }
        return { id: key.id, value: key.value, algorithm: key.algorithm };
    }
    async bootstrapLegacyKey(value) {
        const existing = await this.deploymentKeyRepository.findActiveByType('data_encryption');
        if (existing)
            return;
        await this.deploymentKeyRepository.insertOrIgnore({
            type: 'data_encryption',
            value,
            status: 'active',
            algorithm: 'aes-256-cbc',
        });
    }
    async listKeys(type) {
        if (type)
            return await this.deploymentKeyRepository.findAllByType(type);
        return await this.deploymentKeyRepository.find();
    }
    async rotateKey() {
        const rawKey = (0, node_crypto_1.randomBytes)(32).toString('hex');
        return await this.addKey(rawKey, 'aes-256-gcm', true);
    }
    async addKey(plaintextValue, algorithm, setAsActive = false) {
        const encryptedValue = this.cipher.encryptWithInstanceKey(plaintextValue);
        if (!setAsActive) {
            const entity = this.deploymentKeyRepository.create({
                type: 'data_encryption',
                value: encryptedValue,
                algorithm,
                status: 'inactive',
            });
            return await this.deploymentKeyRepository.save(entity);
        }
        const entity = Object.assign(this.deploymentKeyRepository.create({
            type: 'data_encryption',
            value: encryptedValue,
            algorithm,
        }), { status: 'active' });
        return await this.deploymentKeyRepository.insertAsActive(entity);
    }
    async setActiveKey(id) {
        await this.deploymentKeyRepository.promoteToActive(id, 'data_encryption');
    }
    async markInactive(id) {
        await this.deploymentKeyRepository.update(id, { status: 'inactive' });
    }
};
exports.KeyManagerService = KeyManagerService;
exports.KeyManagerService = KeyManagerService = __decorate([
    (0, di_1.Service)(),
    __metadata("design:paramtypes", [db_1.DeploymentKeyRepository,
        n8n_core_1.Cipher])
], KeyManagerService);
//# sourceMappingURL=key-manager.service.js.map