/**
 * SensitiveDataAccess Entity
 * Security/compliance logging for PII, financial, medical and credential access
 * Compatible with erp-core sensitive-data-access.entity
 *
 * @module Audit
 */

import {
  Entity,
  PrimaryGeneratedColumn,
  Column,
  Index,
} from 'typeorm';

export type DataType = 'pii' | 'financial' | 'medical' | 'credentials';
export type AccessType = 'view' | 'export' | 'modify' | 'decrypt';

@Entity({ name: 'sensitive_data_access', schema: 'audit' })
export class SensitiveDataAccess {
  @PrimaryGeneratedColumn('uuid')
  id: string;

  @Index()
  @Column({ name: 'tenant_id', type: 'uuid' })
  tenantId: string;

  @Index()
  @Column({ name: 'user_id', type: 'uuid' })
  userId: string;

  @Column({ name: 'session_id', type: 'uuid', nullable: true })
  sessionId: string;

  @Index()
  @Column({ name: 'data_type', type: 'varchar', length: 100 })
  dataType: DataType;

  @Column({ name: 'data_category', type: 'varchar', length: 100, nullable: true })
  dataCategory: string;

  @Column({ name: 'entity_type', type: 'varchar', length: 100, nullable: true })
  entityType: string;

  @Column({ name: 'entity_id', type: 'uuid', nullable: true })
  entityId: string;

  @Column({ name: 'access_type', type: 'varchar', length: 30 })
  accessType: AccessType;

  @Column({ name: 'access_reason', type: 'text', nullable: true })
  accessReason: string;

  @Column({ name: 'ip_address', type: 'inet', nullable: true })
  ipAddress: string;

  @Column({ name: 'user_agent', type: 'text', nullable: true })
  userAgent: string;

  @Index()
  @Column({ name: 'was_authorized', type: 'boolean', default: true })
  wasAuthorized: boolean;

  @Column({ name: 'denial_reason', type: 'text', nullable: true })
  denialReason: string;

  @Index()
  @Column({ name: 'accessed_at', type: 'timestamptz', default: () => 'CURRENT_TIMESTAMP' })
  accessedAt: Date;
}
