export type PiiCategory =
  | "contact-email"
  | "contact-phone"
  | "contact-address"
  | "identification-name"
  | "identification-username"
  | "identification-government-id"
  | "auth-credential"
  | "auth-token"
  | "network-ip"
  | "network-user-agent"
  | "financial-info"
  | "behavioral-engagement"
  | "document-content"
  | "derived-metric"
  | (string & Record<never, never>);

export type DataProcessingPurpose =
  | "account-authentication"
  | "transactional-notifications"
  | "marketing-communications"
  | "analytics-aggregation"
  | "legal-compliance"
  | "service-delivery"
  | (string & Record<never, never>);

export type RetentionTrigger =
  | "from-creation"
  | "from-last-access"
  | "after-deletion";

export type RetentionAction = "hard-delete" | "pseudonymize";

export type FieldRetention = {
  duration: string;
  trigger: RetentionTrigger;
  action: RetentionAction;
};

export type FieldPii = {
  category: PiiCategory;
  purpose: DataProcessingPurpose[];
  retention?: FieldRetention;
  exportable: boolean;
  restrictable: boolean;
};

export const PAYLOAD_AUTH_PII_DEFAULTS: Record<string, FieldPii | null> = {
  email: {
    category: "contact-email",
    purpose: ["account-authentication", "transactional-notifications"],
    exportable: true,
    restrictable: true,
  },
  password: null,
  salt: null,
  hash: null,
  resetPasswordToken: null,
  resetPasswordExpiration: null,
  loginAttempts: null,
  lockUntil: null,
  apiKey: null,
  apiKeyIndex: null,
  processingRestrictedAt: null,
  consentState: null,
};
