/**
 * Vendor Types
 *
 * Types for vendor/supplier management:
 * - Vendor roles, statuses, service categories
 * - Processing locations, certifications
 * - Vendor interface with risk scoring
 */

import type { Address, Contact } from './types-common'
import type { DocumentType } from './types-contract'
import type { TransferMechanismType } from './types-processing'

// ==========================================
// ENUMS - VENDOR
// ==========================================

export type VendorRole =
  | 'PROCESSOR'           // Auftragsverarbeiter
  | 'JOINT_CONTROLLER'    // Gemeinsam Verantwortlicher
  | 'CONTROLLER'          // Eigenstaendiger Verantwortlicher
  | 'SUB_PROCESSOR'       // Unterauftragnehmer
  | 'THIRD_PARTY'         // Dritter (kein Datenzugriff)

export type ServiceCategory =
  | 'HOSTING'
  | 'CLOUD_INFRASTRUCTURE'
  | 'ANALYTICS'
  | 'CRM'
  | 'ERP'
  | 'HR_SOFTWARE'
  | 'PAYMENT'
  | 'EMAIL'
  | 'MARKETING'
  | 'SUPPORT'
  | 'SECURITY'
  | 'INTEGRATION'
  | 'CONSULTING'
  | 'LEGAL'
  | 'ACCOUNTING'
  | 'COMMUNICATION'
  | 'STORAGE'
  | 'BACKUP'
  | 'CDN'
  | 'OTHER'

export type DataAccessLevel =
  | 'NONE'                // Kein Datenzugriff
  | 'POTENTIAL'           // Potenzieller Zugriff (z.B. Admin)
  | 'ADMINISTRATIVE'      // Administrativer Zugriff
  | 'CONTENT'             // Inhaltlicher Zugriff

export type VendorStatus =
  | 'ACTIVE'
  | 'INACTIVE'
  | 'PENDING_REVIEW'
  | 'TERMINATED'

export type ReviewFrequency =
  | 'QUARTERLY'
  | 'SEMI_ANNUAL'
  | 'ANNUAL'
  | 'BIENNIAL'

// ==========================================
// INTERFACES - VENDOR
// ==========================================

export interface ProcessingLocation {
  country: string // ISO 3166-1 alpha-2
  region?: string
  city?: string
  dataCenter?: string
  isEU: boolean
  isAdequate: boolean // Angemessenheitsbeschluss
  type?: string // e.g., 'primary', 'backup', 'disaster-recovery'
  description?: string
  isPrimary?: boolean
}

export interface Certification {
  type: string // ISO 27001, SOC2, TISAX, C5, etc.
  issuer?: string
  issuedDate?: Date
  expirationDate?: Date
  scope?: string
  certificateNumber?: string
  documentId?: string // Referenz zum hochgeladenen Zertifikat
}

export interface Vendor {
  id: string
  tenantId: string

  // Stammdaten
  name: string
  legalForm?: string
  country: string
  address: Address
  website?: string

  // Rolle
  role: VendorRole
  serviceDescription: string
  serviceCategory: ServiceCategory

  // Datenzugriff
  dataAccessLevel: DataAccessLevel
  processingLocations: ProcessingLocation[]
  transferMechanisms: TransferMechanismType[]

  // Zertifizierungen
  certifications: Certification[]

  // Kontakte
  primaryContact: Contact
  dpoContact?: Contact
  securityContact?: Contact

  // Vertraege
  contractTypes: DocumentType[]
  contracts: string[] // Contract-IDs

  // Risiko
  inherentRiskScore: number // 0-100 (auto-berechnet)
  residualRiskScore: number // 0-100 (nach Controls)
  manualRiskAdjustment?: number
  riskJustification?: string

  // Review
  reviewFrequency: ReviewFrequency
  lastReviewDate?: Date
  nextReviewDate?: Date

  // Workflow
  status: VendorStatus

  // Linked Processing Activities
  processingActivityIds: string[]

  // Notes
  notes?: string

  createdAt: Date
  updatedAt: Date
}
