security_scope:
  GIRO-D:
    pii: Customer CPF, phone, address
    encryption: AES-256-GCM (Rust aes-gcm)
    auth: Local PIN + license validation
  LICENSE:
    pii: Customer emails, business data
    encryption: PostgreSQL TLS, bcrypt passwords
    auth: JWT with role-based access
  GIRO-M:
    storage: SecureStore for tokens
    auth: JWT from License server
  LEADBOT:
    pii: WhatsApp numbers, messages
    compliance: LGPD consent tracking

use aes_gcm::{
    aead::{Aead, KeyInit},
    Aes256Gcm, Nonce,
};
use base64::{engine::general_purpose::STANDARD, Engine};
use rand::RngCore;

pub struct PiiEncryptor {
    cipher: Aes256Gcm,
}

impl PiiEncryptor {
    pub fn new(key: &[u8; 32]) -> Self {
        let cipher = Aes256Gcm::new_from_slice(key)
            .expect("Invalid key length");
        Self { cipher }
    }

    pub fn encrypt(&self, plaintext: &str) -> Result<String, String> {
        let mut nonce_bytes = [0u8; 12];
        rand::thread_rng().fill_bytes(&mut nonce_bytes);
        let nonce = Nonce::from_slice(&nonce_bytes);

        let ciphertext = self.cipher
            .encrypt(nonce, plaintext.as_bytes())
            .map_err(|e| e.to_string())?;

        // Format: base64(nonce || ciphertext)
        let mut combined = nonce_bytes.to_vec();
        combined.extend(ciphertext);

        Ok(STANDARD.encode(combined))
    }

    pub fn decrypt(&self, encrypted: &str) -> Result<String, String> {
        let combined = STANDARD.decode(encrypted)
            .map_err(|e| e.to_string())?;

        if combined.len() < 12 {
            return Err("Invalid encrypted data".into());
        }

        let (nonce_bytes, ciphertext) = combined.split_at(12);
        let nonce = Nonce::from_slice(nonce_bytes);

        let plaintext = self.cipher
            .decrypt(nonce, ciphertext)
            .map_err(|e| e.to_string())?;

        String::from_utf8(plaintext)
            .map_err(|e| e.to_string())
    }
}

// Nunca armazenar senha em plaintext no frontend
// Usar HTTPS + enviar para backend fazer hash

// Backend (Rust)
use argon2::{
    password_hash::{rand_core::OsRng, PasswordHash, PasswordHasher, PasswordVerifier, SaltString},
    Argon2,
};

pub fn hash_password(password: &str) -> Result<String, String> {
    let salt = SaltString::generate(&mut OsRng);
    let argon2 = Argon2::default();

    argon2
        .hash_password(password.as_bytes(), &salt)
        .map(|hash| hash.to_string())
        .map_err(|e| e.to_string())
}

pub fn verify_password(password: &str, hash: &str) -> Result<bool, String> {
    let parsed_hash = PasswordHash::new(hash)
        .map_err(|e| e.to_string())?;

    Ok(Argon2::default()
        .verify_password(password.as_bytes(), &parsed_hash)
        .is_ok())
}

model Consent {
  id          String   @id @default(uuid())
  userId      String
  purpose     String   // "marketing", "analytics", "essential"
  granted     Boolean
  grantedAt   DateTime @default(now())
  revokedAt   DateTime?
  ipAddress   String
  userAgent   String

  user        User     @relation(fields: [userId], references: [id])

  @@index([userId])
  @@index([purpose])
}

model AuditLog {
  id          String   @id @default(uuid())
  timestamp   DateTime @default(now())
  userId      String?
  action      String   // "CREATE", "READ", "UPDATE", "DELETE"
  resource    String   // "user", "sale", "product"
  resourceId  String?
  oldValue    Json?    // Valor antes (criptografado se PII)
  newValue    Json?    // Valor depois (criptografado se PII)
  ipAddress   String?
  userAgent   String?

  @@index([userId])
  @@index([resource, resourceId])
  @@index([timestamp])
}

// tauri.conf.json
{
  "security": {
    "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'",
    "dangerousDisableAssetCspModification": false
  }
}

// next.config.js
const securityHeaders = [
  {
    key: 'X-DNS-Prefetch-Control',
    value: 'on',
  },
  {
    key: 'Strict-Transport-Security',
    value: 'max-age=63072000; includeSubDomains; preload',
  },
  {
    key: 'X-Frame-Options',
    value: 'SAMEORIGIN',
  },
  {
    key: 'X-Content-Type-Options',
    value: 'nosniff',
  },
  {
    key: 'Referrer-Policy',
    value: 'origin-when-cross-origin',
  },
  {
    key: 'Content-Security-Policy',
    value: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline';",
  },
];

module.exports = {
  async headers() {
    return [
      {
        source: '/:path*',
        headers: securityHeaders,
      },
    ];
  },
};