namespace Baya.Application.Contracts.Common;

/// <summary>
/// Seam for field-level PII encryption (phone, national id, IBAN, addresses, clinical notes).
/// Every encrypted-at-rest column flows through this. The mock uses a local symmetric key; the real
/// implementation swaps to a KMS / column-encryption / Key Vault provider without touching callers.
/// Implementations must never log or surface plaintext.
/// </summary>
public interface IFieldEncryptor
{
    string Encrypt(string plaintext);

    string Decrypt(string ciphertext);

    /// <summary>
    /// Deterministic keyed hash for equality lookups on encrypted columns (e.g. <c>iban_hash</c>) —
    /// the same input always yields the same hash so it can be indexed and queried.
    /// </summary>
    string Hash(string value);
}
