// エンベロープ暗号化の設計
const encryptionConfig = {
  level3: {
    algorithm: "aes-256-gcm",
    kekSource: "AWS KMS",
    dekRotation: "90日",
    kekRotation: "365日",
  },
  level4: {
    algorithm: "aes-256-gcm",
    kekSource: "AWS CloudHSM",
    dekRotation: "30日",
    kekRotation: "180日",
    additionalProtection: "トークナイゼーション（カード番号）",
  },
};

// シークレットアクセスのIAMポリシー
const iamPolicy = {
  Version: "2012-10-17",
  Statement: [
    {
      Effect: "Allow",
      Action: "secretsmanager:GetSecretValue",
      Resource: "arn:aws:secretsmanager:*:*:secret:myapp/payment/*",
      Condition: {
        StringEquals: {
          "aws:PrincipalTag/Service": "payment-service",
        },
      },
    },
  ],
};

const maskingConfig: Record<string, (value: string) => string> = {
  email: (v) => {
    const [local, domain] = v.split("@");
    return `${local[0]}${"*".repeat(local.length - 1)}@${domain}`;
  },
  phone: (v) => v.replace(/\d(?=\d{4})/g, "*"),
  creditCard: (v) => `****-****-****-${v.slice(-4)}`,
  address: (v) => {
    const parts = v.split(/[都道府県]/);
    return parts[0] + "***" + (parts.length > 1 ? "***" : "");
  },
  name: (v) => v[0] + "*".repeat(v.length - 1),
};

// コンテキスト別のマスキングレベル
type ViewContext = "owner" | "admin" | "support" | "analytics";

const getMaskingLevel = (context: ViewContext, field: string): "full" | "masked" | "hidden" => {
  const rules: Record<ViewContext, Record<string, "full" | "masked" | "hidden">> = {
    owner: { email: "full", phone: "full", creditCard: "masked", name: "full" },
    admin: { email: "masked", phone: "masked", creditCard: "hidden", name: "masked" },
    support: { email: "masked", phone: "masked", creditCard: "hidden", name: "full" },
    analytics: { email: "hidden", phone: "hidden", creditCard: "hidden", name: "hidden" },
  };
  return rules[context]?.[field] ?? "hidden";
};

// 自動削除ジョブの設計
const retentionJobs = [
  { cron: "0 2 * * *", task: "deleteExpiredSessions" },      // 毎日2時
  { cron: "0 3 * * 0", task: "archiveOldLogs" },             // 毎週日曜3時
  { cron: "0 4 1 * *", task: "anonymizeOldOrders" },         // 毎月1日4時
  { cron: "0 5 1 * *", task: "deleteExpiredPaymentData" },   // 毎月1日5時
];