namespace ZB.MOM.WW.Secrets.Abstractions;

/// <summary>
/// The safe, UI-facing projection of a secret. Deliberately carries <b>no</b>
/// <see cref="byte"/> array members, so neither ciphertext nor plaintext can leak into
/// rendered markup or logs via this type — it is safe to bind directly in management UIs.
/// </summary>
public record SecretMetadata
{
    /// <summary>The normalized secret name.</summary>
    public required SecretName Name { get; init; }

    /// <summary>Optional human-readable description.</summary>
    public string? Description { get; init; }

    /// <summary>How the decrypted plaintext should be interpreted.</summary>
    public required SecretContentType ContentType { get; init; }

    /// <summary>Identifier of the key-encryption key (KEK) that wrapped the DEK.</summary>
    public required string KekId { get; init; }

    /// <summary>Monotonic revision number.</summary>
    public required long Revision { get; init; }

    /// <summary>Whether the secret is soft-deleted (tombstoned).</summary>
    public bool IsDeleted { get; init; }

    /// <summary>When the secret was first created (UTC).</summary>
    public required DateTimeOffset CreatedUtc { get; init; }

    /// <summary>When the secret was last updated (UTC).</summary>
    public required DateTimeOffset UpdatedUtc { get; init; }

    /// <summary>Principal that created the secret, if known.</summary>
    public string? CreatedBy { get; init; }

    /// <summary>Principal that last updated the secret, if known.</summary>
    public string? UpdatedBy { get; init; }
}