import { createClient } from "@supabase/supabase-js";
import { AegisClient, SupabaseAdapter, importKey, generateBidxKey } from "aegis-lock";

const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
const adapter = new SupabaseAdapter(supabase);

// 1. Setup your Key Ring for Key Rotation
// You should load these base64 strings securely from your environment variables
const keyRing = {
  "v1": await importKey(process.env.AEGIS_KEY_V1),
  "v2": await importKey(process.env.AEGIS_KEY_V2) // Your newest key
};
const activeVersion = "v2"; 

const bidxKey = await generateBidxKey(); // Or import your saved blind index key

// 2. Initialize the Client
const aegis = new AegisClient({
  adapter,
  primaryKeyField: "record_id", // REQUIRED: Binds ciphertext to the row to prevent tampering
  encryptedFields: {
    secure_fields: ["encrypted_content", "ssn", "email"]
  },
  bidxFields: {
    secure_fields: ["email"] // Optional: Creates an 'email_bidx' column for searching
  }
}, keyRing, activeVersion, bidxKey);

// 3. Insert — fields are auto-encrypted using the 'v2' key. 
// Note: You MUST provide the primary key application-side!
await aegis.insert("secure_fields", {
  record_id: "uuid-1234-5678", 
  email: "alice@example.com",
  encrypted_content: "Top secret",
});

// 4. Select — Aegis automatically hashes the email to search the 'email_bidx' column securely.
// It will dynamically select the correct key from the KeyRing to decrypt the results.
const { data } = await aegis.select("secure_fields", { 
  column: "email", 
  value: "alice@example.com" 
});

// 5. Update — automatically re-encrypts with a new IV and the active 'v2' key.
await aegis.update("secure_fields", {
  record_id: "uuid-1234-5678", // Must include the primary key!
  email: "new_alice@example.com",
  encrypted_content: "New secret"
});

// 6. Delete — Aegis automatically hashes the email to find the correct row to delete
await aegis.delete("secure_fields", {
  column: "email",
  value: "new_alice@example.com"
});

import { MongoClient } from "mongodb";
import { AegisClient, MongoDBAdapter, importKey } from "aegis-lock";
import { v4 as uuidv4 } from "uuid";

const mongo = new MongoClient("mongodb://localhost:27017");
await mongo.connect();
const adapter = new MongoDBAdapter(mongo.db("myapp"));

const keyRing = { "v1": await importKey(process.env.AEGIS_MASTER_KEY) };

const aegis = new AegisClient({
  adapter,
  primaryKeyField: "_id", 
  encryptedFields: {
    users: ["ssn", "credit_card"]
  }
}, keyRing, "v1");

const newUserId = uuidv4();

// Insert with a client-generated ID
await aegis.insert("users", { 
  _id: newUserId, 
  name: "Alice", 
  ssn: "123-45-6789" 
});

// Select by an unencrypted field
const { data } = await aegis.select("users", { 
  column: "name", 
  value: "Alice" 
});
// data[0].ssn → "123-45-6789" (decrypted)

import { DatabaseAdapter } from "aegis-lock";

class MyAdapter implements DatabaseAdapter {
  async insert(table: string, data: Record<string, unknown>) {
    // your insert logic
    return { data: [data], error: null };
  }
  async select(table: string, query?) {
    // your select logic
    return { data: [], error: null };
  }
  async update(table: string, data: Record<string, unknown>) {
    // your update logic
    return { data: [data], error: null };
  }
  async delete(table: string, query: { column: string; value: unknown }) {
    // your delete logic
    return { data: [], error: null };
  }
}