api

type EncryptedData struct {
	Ciphertext         []byte            // Encrypted data
	WrappedDEK         []byte            // DEK encrypted by KEK
	KeyID              string            // Key identifier for KEK
	Algorithm          string            // Encryption algorithm used
	AdditionalMetadata map[string]string // Additional metadata (nonce, version, etc.)
}

type EncryptionLevel int

type EncryptionMetadata struct {
	Algorithm  string `json:"algorithm"`
	KeyVersion int    `json:"key_version"`
	Nonce      string `json:"nonce"` // Base64 encoded nonce
	AAD        string `json:"aad"`   // Base64 encoded additional authenticated data
}

type EncryptionService interface {
	// EncryptMessage encrypts a message using envelope encryption
	// associatedData is used for authenticated encryption (AAD)
	EncryptMessage(ctx context.Context, plaintext []byte, associatedData string) (*EncryptedData, error)

	// DecryptMessage decrypts an encrypted message
	// associatedData must match what was used during encryption
	DecryptMessage(ctx context.Context, data *EncryptedData, associatedData string) ([]byte, error)

	// GetKeyID returns the current key identifier from the underlying KMS
	GetKeyID() string

	// Close releases any resources
	Close() error
}

type KMSProvider interface {
	// GenerateDEK generates a new Data Encryption Key
	// Returns plaintext DEK and wrapped (encrypted) DEK
	GenerateDEK(ctx context.Context) (plaintext []byte, wrapped []byte, err error)

	// WrapDEK wraps (encrypts) a DEK using the KEK
	WrapDEK(ctx context.Context, plaintext []byte) (wrapped []byte, err error)

	// UnwrapDEK unwraps (decrypts) a wrapped DEK using the KEK
	UnwrapDEK(ctx context.Context, wrapped []byte) (plaintext []byte, err error)

	// GetKeyID returns the current key identifier
	GetKeyID() string

	// RotateKey triggers a key rotation (creates new version)
	RotateKey(ctx context.Context) error

	// Close releases any resources held by the provider
	Close() error
}

type KMSProviderType string