/**
 * Vault Service Constants
 *
 * Named Transit encryption keys and related constants for OpenBao integration.
 */

/**
 * Named Transit encryption keys
 *
 * Each key is used for encrypting specific types of sensitive data.
 * Keys are created automatically by the openbao-init container on first run.
 */
export enum TransitKey {
  /** User-stored credentials (API keys, git tokens) */
  CREDENTIALS = "mosaic-credentials",

  /** BetterAuth OAuth tokens in accounts table */
  ACCOUNT_TOKENS = "mosaic-account-tokens",

  /** Federation private keys */
  FEDERATION = "mosaic-federation",

  /** LLM provider API keys */
  LLM_CONFIG = "mosaic-llm-config",
}

/**
 * Default OpenBao server address
 */
export const DEFAULT_OPENBAO_ADDR = "http://openbao:8200";

/**
 * AppRole credentials file path (mounted via Docker volume)
 */
export const APPROLE_CREDENTIALS_PATH = "/openbao/init/approle-credentials";

/**
 * Token renewal threshold (percentage of TTL)
 * Renew when remaining TTL drops below this percentage
 */
export const TOKEN_RENEWAL_THRESHOLD = 0.5; // 50%

/**
 * Token TTL in seconds (1 hour)
 */
export const TOKEN_TTL_SECONDS = 3600;
