encryption

type ActiveInfo struct {
	Strategy  string `json:"strategy"`  // "v1"
	KeyID     string `json:"key_id"`    // "default"
	Algorithm string `json:"algorithm"` // "AES-256-GCM"
}

type Canary struct {
	Strategy       string    `json:"strategy"`        // e.g., "v1"
	KeyID          string    `json:"key_id"`          // e.g., "default"
	EncryptedValue []byte    `json:"encrypted_value"` // e.g., "enc:v1:default:..."
	CreatedAt      time.Time `json:"created_at"`
}

type CanaryManager struct {
	// contains filtered or unexported fields
}

type CanaryStore interface {
	// Get retrieves a canary for the given strategy and keyID.
	// Returns nil if not found.
	Get(ctx context.Context, strategy, keyID string) (*Canary, error)

	// Save creates or updates a canary.
	Save(ctx context.Context, canary *Canary) error

	// GetAll retrieves all stored canaries.
	GetAll(ctx context.Context) ([]Canary, error)
}

type Ciphertext []byte

type EncryptFunc func(ctx context.Context, data []byte) ([]byte, error)

type EncryptionStatus struct {
	Enabled             bool        `json:"enabled"`
	Active              *ActiveInfo `json:"active,omitempty"`
	CanaryChecksEnabled bool        `json:"canary_checks_enabled"`
	Keys                []KeyStatus `json:"keys"`
}

type KeyStatus struct {
	Strategy     string `json:"strategy"`      // "v1"
	KeyID        string `json:"key_id"`        // "default"
	Configured   bool   `json:"configured"`    // Is this key currently configured in the strategy?
	Active       bool   `json:"active"`        // Is this the active strategy+key?
	CanaryStatus string `json:"canary_status"` // "ok", "failed", "not_checked", "key_missing"
}

type Manager struct {
	// contains filtered or unexported fields
}

type MetricsRecorder interface {
	RecordOperation(operation, strategy, keyID, status string, duration time.Duration)
	RecordError(operation, strategy, keyID, errorType string)
	RecordCanaryValidation(strategy, keyID, status string)
}

type ModelEncryptHandler func(ctx context.Context, model any, encrypt EncryptFunc) error

type ParsedEncrypted struct {
	// KeyID identifies the key that encrypted this value.
	KeyID string

	// Payload contains the strategy-specific encrypted payload.
	// For v1, this is nonce||ciphertext||tag after base64 decoding.
	Payload []byte

	// Metadata contains optional non-sensitive strategy-specific metadata.
	// It must not contain plaintext, ciphertext, key material, nonces,
	// authentication tags, or customer/resource identifiers.
	Metadata map[string]string
}

type Plaintext []byte

type Plugin struct {
	// contains filtered or unexported fields
}

type Strategy interface {
	// Version returns the immutable version identifier (e.g., "v1", "v2").
	// This should be a simple version string, not include key IDs or key source types.
	Version() string

	// String returns human-readable status information about this strategy.
	// Should include: algorithm, active key ID, configured keys, etc.
	// NEVER include actual key material.
	// Example: "AES-256-GCM, active_key=default, keys=[default, key2]"
	// Used by encryption status endpoints and diagnostics.
	String() string

	// ActiveKeyID returns the identifier of the currently active encryption key.
	// This is the key used for all new encryptions.
	ActiveKeyID() string

	// Algorithm returns the algorithm name (e.g., "AES-256-GCM").
	Algorithm() string

	// ConfiguredKeys returns all configured key IDs for this strategy.
	ConfiguredKeys() []string

	// EncryptPlaintext encrypts plaintext using the strategy's active key.
	// Returns the strategy-specific body containing the key ID and encrypted payload,
	EncryptPlaintext(ctx context.Context, plaintext []byte) ([]byte, error)

	// EncryptWithKey encrypts plaintext using a specific key by ID.
	// Same return format as EncryptPlaintext.
	EncryptWithKey(ctx context.Context, keyID string, plaintext []byte) ([]byte, error)

	// ParseBody parses the body returned by EncryptPlaintext/EncryptWithKey
	// into a ParsedEncrypted containing the key ID and raw payload.
	ParseBody(body []byte) (*ParsedEncrypted, error)

	// DecryptParsed decrypts a value previously parsed by ParseBody.
	DecryptParsed(ctx context.Context, parsed *ParsedEncrypted) ([]byte, error)
}

type V1Strategy struct {
	// contains filtered or unexported fields
}

type ValidationResult struct {
	Strategy string `json:"strategy"`
	KeyID    string `json:"key_id"`
	Status   string `json:"status"` // "ok", "failed", "mismatch"
	Error    string `json:"error,omitempty"`
}