/**
 * DSFA Assessment Types - Sub-types and main DSFA interface
 *
 * Risk, mitigation, review, threshold analysis, stakeholder consultation,
 * and the main DSFA data model.
 */

import type {
  DSFAStatus,
  DSFARiskLevel,
  DSFARiskCategory,
  DSFAMitigationType,
  DSFAMitigationStatus,
} from './types-core'

// =============================================================================
// SUB-TYPES
// =============================================================================

export interface DSFARisk {
  id: string
  category: DSFARiskCategory
  description: string
  likelihood: 'low' | 'medium' | 'high'
  impact: 'low' | 'medium' | 'high'
  risk_level: string
  affected_data: string[]
}

export interface DSFAMitigation {
  id: string
  risk_id: string
  description: string
  type: DSFAMitigationType
  status: DSFAMitigationStatus
  implemented_at?: string
  verified_at?: string
  residual_risk: 'low' | 'medium' | 'high'
  tom_reference?: string
  responsible_party: string
}

export interface DSFAReviewComment {
  id: string
  section: number
  comment: string
  created_by: string
  created_at: string
  resolved: boolean
}

export interface DSFASectionProgress {
  section_0_complete: boolean  // Schwellwertanalyse
  section_1_complete: boolean  // Systematische Beschreibung
  section_2_complete: boolean  // Notwendigkeit & Verhältnismäßigkeit
  section_3_complete: boolean  // Risikobewertung
  section_4_complete: boolean  // Abhilfemaßnahmen
  section_5_complete: boolean  // Betroffenenperspektive (optional)
  section_6_complete: boolean  // DSB & Behördenkonsultation
  section_7_complete: boolean  // Fortschreibung & Review
}

// =============================================================================
// SCHWELLWERTANALYSE / VORABPRÜFUNG (Art. 35 Abs. 1 DSGVO)
// =============================================================================

export interface DSFAThresholdAnalysis {
  id: string
  dsfa_id?: string
  performed_at: string
  performed_by: string

  // WP248 Kriterien-Bewertung
  criteria_assessment: Array<{
    criterion_id: string  // K1-K9
    applies: boolean
    justification: string
  }>

  // Art. 35 Abs. 3 Prüfung
  art35_abs3_assessment: Array<{
    case_id: string  // a, b, c
    applies: boolean
    justification: string
  }>

  // Ergebnis
  dsfa_required: boolean
  decision_justification: string

  // Dokumentation der Entscheidung (gem. DSK Kurzpapier Nr. 5)
  documented: boolean
  documentation_reference?: string
}

// =============================================================================
// BETROFFENENPERSPEKTIVE (Art. 35 Abs. 9 DSGVO)
// =============================================================================

export interface DSFAStakeholderConsultation {
  id: string
  stakeholder_type: 'data_subjects' | 'representatives' | 'works_council' | 'other'
  stakeholder_description: string
  consultation_date?: string
  consultation_method: 'survey' | 'interview' | 'workshop' | 'written' | 'other'
  summary: string
  concerns_raised: string[]
  addressed_in_dsfa: boolean
  response_documentation?: string
}

// =============================================================================
// ART. 36 KONSULTATIONSPFLICHT
// =============================================================================

export interface DSFAConsultationRequirement {
  high_residual_risk: boolean
  consultation_required: boolean  // Art. 36 Abs. 1 DSGVO
  consultation_reason?: string
  authority_notified: boolean
  notification_date?: string
  authority_response?: string
  authority_recommendations?: string[]
  waiting_period_observed: boolean  // 8 Wochen gem. Art. 36 Abs. 2
}

// =============================================================================
// FORTSCHREIBUNG / REVIEW (Art. 35 Abs. 11 DSGVO)
// =============================================================================

export interface DSFAReviewTrigger {
  id: string
  trigger_type: 'scheduled' | 'risk_change' | 'new_technology' | 'new_purpose' | 'incident' | 'regulatory' | 'other'
  description: string
  detected_at: string
  detected_by: string
  review_required: boolean
  review_completed: boolean
  review_date?: string
  changes_made: string[]
}

export interface DSFAReviewSchedule {
  next_review_date: string
  review_frequency_months: number
  last_review_date?: string
  review_responsible: string
}

// =============================================================================
// MAIN DSFA TYPE
// =============================================================================

export interface DSFA {
  id: string
  tenant_id: string
  namespace_id?: string
  processing_activity_id?: string
  assessment_id?: string
  name: string
  description: string

  // Section 0: Schwellwertanalyse / Vorabprüfung (NEU - Art. 35 Abs. 1)
  threshold_analysis?: DSFAThresholdAnalysis
  wp248_criteria_met?: string[]  // IDs der erfüllten WP248-Kriterien (K1-K9)
  art35_abs3_triggered?: string[]  // IDs der ausgelösten Art. 35 Abs. 3 Fälle

  // Section 1: Systematische Beschreibung (Art. 35 Abs. 7 lit. a)
  processing_description: string
  processing_purpose: string
  data_categories: string[]
  data_subjects: string[]
  recipients: string[]
  legal_basis: string
  legal_basis_details?: string

  // Section 2: Notwendigkeit & Verhältnismäßigkeit (Art. 35 Abs. 7 lit. b)
  necessity_assessment: string
  proportionality_assessment: string
  data_minimization?: string
  alternatives_considered?: string
  retention_justification?: string

  // Section 3: Risikobewertung (Art. 35 Abs. 7 lit. c)
  risks: DSFARisk[]
  overall_risk_level: DSFARiskLevel
  risk_score: number
  affected_rights?: string[]
  triggered_rule_codes?: string[]

  // KI-spezifische Trigger (NEU)
  involves_ai?: boolean
  ai_trigger_ids?: string[]  // IDs der ausgelösten KI-Trigger

  // Section 4: Abhilfemaßnahmen (Art. 35 Abs. 7 lit. d)
  mitigations: DSFAMitigation[]
  tom_references?: string[]
  residual_risk_level?: DSFARiskLevel  // Restrisiko nach Maßnahmen

  // Section 5: Stellungnahme DSB (Art. 35 Abs. 2 + Art. 36)
  dpo_consulted: boolean
  dpo_consulted_at?: string
  dpo_name?: string
  dpo_opinion?: string
  dpo_approved?: boolean
  authority_consulted: boolean
  authority_consulted_at?: string
  authority_reference?: string
  authority_decision?: string

  // Art. 36 Konsultationspflicht (NEU)
  consultation_requirement?: DSFAConsultationRequirement

  // Betroffenenperspektive (NEU - Art. 35 Abs. 9)
  stakeholder_consultations?: DSFAStakeholderConsultation[]
  stakeholder_consultation_not_appropriate?: boolean
  stakeholder_consultation_not_appropriate_reason?: string

  // Workflow & Approval
  status: DSFAStatus
  submitted_for_review_at?: string
  submitted_by?: string
  conclusion: string
  review_comments?: DSFAReviewComment[]

  // Section Progress Tracking
  section_progress: DSFASectionProgress

  // Fortschreibung / Review (NEU - Art. 35 Abs. 11)
  review_schedule?: DSFAReviewSchedule
  review_triggers?: DSFAReviewTrigger[]
  version: number  // DSFA-Version für Fortschreibung
  previous_version_id?: string

  // Referenzen zu behördlichen Ressourcen
  federal_state?: string  // Bundesland für zuständige Aufsichtsbehörde
  authority_resource_id?: string  // ID aus DSFA_AUTHORITY_RESOURCES

  // Metadata & Audit
  metadata?: Record<string, unknown>
  created_at: string
  updated_at: string
  created_by: string
  approved_by?: string
  approved_at?: string
}
