ipfrs-storage 0.2.0

//! Storage Encryption Layer (`storage_encryption_layer`)
//!
//! Production-quality encryption layer for block storage using pure-Rust
//! stream cipher implementations (ChaCha20, XSalsa20, Xor256).
//!
//! Features:
//! - Inline ChaCha20 (20-round, quarter-round based)
//! - Inline XSalsa20 (HSalsa20 key derivation + Salsa20)
//! - Xor256 (256-byte repeating XOR for testing)
//! - Key store with rotation support
//! - Encrypted block index for decrypt-by-CID lookup
//! - Bounded audit log (1000 entries)
//! - FNV-1a MAC verification
//! - Batch encrypt / re-encrypt operations

use std::collections::{HashMap, VecDeque};

// ── Type aliases ────────────────────────────────────────────────────────────

/// 16-byte key identifier.
pub type KeyId = [u8; 16];
/// 32-byte block content identifier.
pub type BlockCid = [u8; 32];

// ── Error type ───────────────────────────────────────────────────────────────

/// Errors produced by [`StorageEncryptionLayer`].
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum SelError {
    /// No active key has been set.
    NoActiveKey,
    /// The requested key identifier was not found.
    KeyNotFound(KeyId),
    /// The CID was not found in the encrypted block index.
    BlockNotFound(BlockCid),
    /// Cipher internal error (e.g. input too large).
    CipherError(String),
    /// MAC verification failed.
    MacMismatch,
}

impl std::fmt::Display for SelError {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::NoActiveKey => write!(f, "no active encryption key"),
            Self::KeyNotFound(id) => write!(f, "key not found: {:?}", id),
            Self::BlockNotFound(cid) => write!(f, "block not found in index: {:?}", cid),
            Self::CipherError(msg) => write!(f, "cipher error: {msg}"),
            Self::MacMismatch => write!(f, "MAC verification failed"),
        }
    }
}

impl std::error::Error for SelError {}

// ── Cipher selection ─────────────────────────────────────────────────────────

/// Stream cipher variant to use for block encryption.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
pub enum SelCipher {
    /// ChaCha20 (20 rounds, RFC 8439 layout).
    #[default]
    ChaCha20,
    /// XSalsa20 (extended 192-bit nonce).
    XSalsa20,
    /// Repeating 256-byte XOR (for unit testing only).
    Xor256,
}

// ── Configuration ────────────────────────────────────────────────────────────

/// Configuration for [`StorageEncryptionLayer`].
#[derive(Debug, Clone)]
pub struct SelEncryptionConfig {
    /// Which cipher to use for new encryptions.
    pub cipher: SelCipher,
    /// Seconds between automatic key rotations (0 = disabled).
    pub key_rotation_interval_secs: u64,
    /// Whether to record operations in the audit log.
    pub enable_audit: bool,
}

impl Default for SelEncryptionConfig {
    fn default() -> Self {
        Self {
            cipher: SelCipher::ChaCha20,
            key_rotation_interval_secs: 0,
            enable_audit: true,
        }
    }
}

// ── Key material ─────────────────────────────────────────────────────────────

/// A symmetric encryption key with metadata.
#[derive(Debug, Clone)]
pub struct SelEncryptionKey {
    /// Key identifier (16 bytes).
    pub id: KeyId,
    /// Raw key bytes (32 bytes).
    pub key_bytes: Vec<u8>,
    /// UNIX timestamp (seconds) when this key was created.
    pub created_at: u64,
    /// Key identifier this was rotated from, if any.
    pub rotated_from: Option<KeyId>,
}

/// Public type alias for [`SelEncryptionKey`].
pub type EncryptionKey = SelEncryptionKey;

// ── Encrypted block record ────────────────────────────────────────────────────

/// Index record for an encrypted block.
#[derive(Debug, Clone)]
pub struct SelEncryptedBlockRecord {
    /// Original plaintext CID.
    pub cid: BlockCid,
    /// CID of the encrypted form (FNV-1a derived from ciphertext).
    pub encrypted_cid: [u8; 32],
    /// Key identifier used during encryption.
    pub key_id: KeyId,
    /// 24-byte nonce used during encryption.
    pub nonce: [u8; 24],
    /// Size of the encrypted payload (bytes).
    pub size_enc: usize,
    /// UNIX timestamp (seconds) when this record was created.
    pub created_at: u64,
}

/// Public type alias for [`SelEncryptedBlockRecord`].
pub type EncryptedBlockRecord = SelEncryptedBlockRecord;

// ── Audit entry ───────────────────────────────────────────────────────────────

/// A single entry in the bounded audit log.
#[derive(Debug, Clone)]
pub struct EncAuditEntry {
    /// UNIX timestamp (seconds).
    pub ts: u64,
    /// Human-readable operation name.
    pub op: String,
    /// Key involved, if applicable.
    pub key_id: Option<KeyId>,
    /// Block CID involved, if applicable.
    pub block_cid: Option<BlockCid>,
}

// ── Statistics ────────────────────────────────────────────────────────────────

/// Aggregate statistics for [`StorageEncryptionLayer`].
#[derive(Debug, Clone, Default)]
pub struct SelEncryptionStats {
    /// Total blocks encrypted since creation.
    pub blocks_encrypted: u64,
    /// Total blocks decrypted since creation.
    pub blocks_decrypted: u64,
    /// Total key-rotation operations performed.
    pub key_rotations: u64,
    /// Total re-encryption operations performed.
    pub re_encryptions: u64,
    /// Number of MAC verifications that passed.
    pub mac_ok: u64,
    /// Number of MAC verifications that failed.
    pub mac_fail: u64,
    /// Number of keys currently in the key store.
    pub key_count: usize,
    /// Number of blocks currently in the encrypted block index.
    pub index_size: usize,
    /// Number of entries in the audit log.
    pub audit_log_len: usize,
}

// ── Inline PRNG ───────────────────────────────────────────────────────────────

#[inline(always)]
fn xorshift64(state: &mut u64) -> u64 {
    let mut x = *state;
    x ^= x << 13;
    x ^= x >> 7;
    x ^= x << 17;
    *state = x;
    x
}

// ── Inline FNV-1a ─────────────────────────────────────────────────────────────

#[inline(always)]
fn fnv1a_64(data: &[u8]) -> u64 {
    let mut h: u64 = 14_695_981_039_346_656_037;
    for &b in data {
        h ^= b as u64;
        h = h.wrapping_mul(1_099_511_628_211);
    }
    h
}

// ── Inline timestamp helper ───────────────────────────────────────────────────

fn unix_ts() -> u64 {
    use std::time::{SystemTime, UNIX_EPOCH};
    SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .map(|d| d.as_secs())
        .unwrap_or(0)
}

// ── ChaCha20 (20 rounds, pure Rust) ──────────────────────────────────────────
//
// RFC 8439 §2.1 quarter-round, §2.3 block function.

#[inline(always)]
fn chacha20_quarter_round(state: &mut [u32; 16], a: usize, b: usize, c: usize, d: usize) {
    state[a] = state[a].wrapping_add(state[b]);
    state[d] ^= state[a];
    state[d] = state[d].rotate_left(16);

    state[c] = state[c].wrapping_add(state[d]);
    state[b] ^= state[c];
    state[b] = state[b].rotate_left(12);

    state[a] = state[a].wrapping_add(state[b]);
    state[d] ^= state[a];
    state[d] = state[d].rotate_left(8);

    state[c] = state[c].wrapping_add(state[d]);
    state[b] ^= state[c];
    state[b] = state[b].rotate_left(7);
}

/// Produce one 64-byte ChaCha20 keystream block.
///
/// * `key`   – 32-byte key
/// * `nonce` – 12-byte nonce (bytes 0..12 of the 24-byte nonce field)
/// * `counter` – 32-bit block counter
fn chacha20_block(key: &[u8; 32], nonce: &[u8; 12], counter: u32) -> [u8; 64] {
    // Constants: "expand 32-byte k"
    let mut state: [u32; 16] = [
        0x6170_7865,
        0x3320_646e,
        0x7962_2d32,
        0x6b20_6574,
        u32::from_le_bytes([key[0], key[1], key[2], key[3]]),
        u32::from_le_bytes([key[4], key[5], key[6], key[7]]),
        u32::from_le_bytes([key[8], key[9], key[10], key[11]]),
        u32::from_le_bytes([key[12], key[13], key[14], key[15]]),
        u32::from_le_bytes([key[16], key[17], key[18], key[19]]),
        u32::from_le_bytes([key[20], key[21], key[22], key[23]]),
        u32::from_le_bytes([key[24], key[25], key[26], key[27]]),
        u32::from_le_bytes([key[28], key[29], key[30], key[31]]),
        counter,
        u32::from_le_bytes([nonce[0], nonce[1], nonce[2], nonce[3]]),
        u32::from_le_bytes([nonce[4], nonce[5], nonce[6], nonce[7]]),
        u32::from_le_bytes([nonce[8], nonce[9], nonce[10], nonce[11]]),
    ];

    let working = state;
    let mut work = working;

    for _ in 0..10 {
        // Column rounds
        chacha20_quarter_round(&mut work, 0, 4, 8, 12);
        chacha20_quarter_round(&mut work, 1, 5, 9, 13);
        chacha20_quarter_round(&mut work, 2, 6, 10, 14);
        chacha20_quarter_round(&mut work, 3, 7, 11, 15);
        // Diagonal rounds
        chacha20_quarter_round(&mut work, 0, 5, 10, 15);
        chacha20_quarter_round(&mut work, 1, 6, 11, 12);
        chacha20_quarter_round(&mut work, 2, 7, 8, 13);
        chacha20_quarter_round(&mut work, 3, 4, 9, 14);
    }

    for (s, w) in state.iter_mut().zip(work.iter()) {
        *s = s.wrapping_add(*w);
    }

    let mut out = [0u8; 64];
    for (i, word) in state.iter().enumerate() {
        let b = word.to_le_bytes();
        out[i * 4..i * 4 + 4].copy_from_slice(&b);
    }
    out
}

/// ChaCha20 keystream XOR.
///
/// `nonce` – 12 bytes (first 12 of the 24-byte nonce stored in the record).
fn chacha20_xor(key: &[u8; 32], nonce: &[u8; 12], input: &[u8]) -> Vec<u8> {
    let mut output = Vec::with_capacity(input.len());
    let mut counter: u32 = 0;
    let mut offset = 0;

    while offset < input.len() {
        let block = chacha20_block(key, nonce, counter);
        let block_end = (offset + 64).min(input.len());
        let chunk = &input[offset..block_end];
        for (b, k) in chunk.iter().zip(block.iter()) {
            output.push(b ^ k);
        }
        offset += chunk.len();
        counter = counter.wrapping_add(1);
    }
    output
}

// ── XSalsa20 (pure Rust) ─────────────────────────────────────────────────────
//
// XSalsa20 = HSalsa20(key, nonce[0..16]) → subkey, then Salsa20(subkey, nonce[16..24]).

#[inline(always)]
fn salsa20_quarter_round(state: &mut [u32; 16], a: usize, b: usize, c: usize, d: usize) {
    state[b] ^= state[a].wrapping_add(state[d]).rotate_left(7);
    state[c] ^= state[b].wrapping_add(state[a]).rotate_left(9);
    state[d] ^= state[c].wrapping_add(state[b]).rotate_left(13);
    state[a] ^= state[d].wrapping_add(state[c]).rotate_left(18);
}

/// HSalsa20: derive a 32-byte subkey from `key` and `nonce[0..16]`.
fn hsalsa20(key: &[u8; 32], nonce16: &[u8; 16]) -> [u8; 32] {
    let mut state: [u32; 16] = [
        0x6170_7865,
        u32::from_le_bytes([key[0], key[1], key[2], key[3]]),
        u32::from_le_bytes([key[4], key[5], key[6], key[7]]),
        u32::from_le_bytes([key[8], key[9], key[10], key[11]]),
        u32::from_le_bytes([key[12], key[13], key[14], key[15]]),
        0x3320_646e,
        u32::from_le_bytes([nonce16[0], nonce16[1], nonce16[2], nonce16[3]]),
        u32::from_le_bytes([nonce16[4], nonce16[5], nonce16[6], nonce16[7]]),
        u32::from_le_bytes([nonce16[8], nonce16[9], nonce16[10], nonce16[11]]),
        u32::from_le_bytes([nonce16[12], nonce16[13], nonce16[14], nonce16[15]]),
        0x7962_2d32,
        u32::from_le_bytes([key[16], key[17], key[18], key[19]]),
        u32::from_le_bytes([key[20], key[21], key[22], key[23]]),
        u32::from_le_bytes([key[24], key[25], key[26], key[27]]),
        u32::from_le_bytes([key[28], key[29], key[30], key[31]]),
        0x6b20_6574,
    ];

    for _ in 0..10 {
        // Column rounds
        salsa20_quarter_round(&mut state, 0, 4, 8, 12);
        salsa20_quarter_round(&mut state, 5, 9, 13, 1);
        salsa20_quarter_round(&mut state, 10, 14, 2, 6);
        salsa20_quarter_round(&mut state, 15, 3, 7, 11);
        // Diagonal rounds
        salsa20_quarter_round(&mut state, 0, 1, 2, 3);
        salsa20_quarter_round(&mut state, 5, 6, 7, 4);
        salsa20_quarter_round(&mut state, 10, 11, 8, 9);
        salsa20_quarter_round(&mut state, 15, 12, 13, 14);
    }

    let mut subkey = [0u8; 32];
    for (i, &idx) in [0usize, 5, 10, 15, 6, 7, 8, 9].iter().enumerate() {
        let b = state[idx].to_le_bytes();
        subkey[i * 4..i * 4 + 4].copy_from_slice(&b);
    }
    subkey
}

/// Produce one 64-byte Salsa20 keystream block.
fn salsa20_block(key: &[u8; 32], nonce8: &[u8; 8], counter: u64) -> [u8; 64] {
    let ctr_lo = counter as u32;
    let ctr_hi = (counter >> 32) as u32;
    let mut state: [u32; 16] = [
        0x6170_7865,
        u32::from_le_bytes([key[0], key[1], key[2], key[3]]),
        u32::from_le_bytes([key[4], key[5], key[6], key[7]]),
        u32::from_le_bytes([key[8], key[9], key[10], key[11]]),
        u32::from_le_bytes([key[12], key[13], key[14], key[15]]),
        0x3320_646e,
        u32::from_le_bytes([nonce8[0], nonce8[1], nonce8[2], nonce8[3]]),
        u32::from_le_bytes([nonce8[4], nonce8[5], nonce8[6], nonce8[7]]),
        ctr_lo,
        ctr_hi,
        0x7962_2d32,
        u32::from_le_bytes([key[16], key[17], key[18], key[19]]),
        u32::from_le_bytes([key[20], key[21], key[22], key[23]]),
        u32::from_le_bytes([key[24], key[25], key[26], key[27]]),
        u32::from_le_bytes([key[28], key[29], key[30], key[31]]),
        0x6b20_6574,
    ];

    let working = state;
    let mut work = working;

    for _ in 0..10 {
        salsa20_quarter_round(&mut work, 0, 4, 8, 12);
        salsa20_quarter_round(&mut work, 5, 9, 13, 1);
        salsa20_quarter_round(&mut work, 10, 14, 2, 6);
        salsa20_quarter_round(&mut work, 15, 3, 7, 11);
        salsa20_quarter_round(&mut work, 0, 1, 2, 3);
        salsa20_quarter_round(&mut work, 5, 6, 7, 4);
        salsa20_quarter_round(&mut work, 10, 11, 8, 9);
        salsa20_quarter_round(&mut work, 15, 12, 13, 14);
    }

    for (s, w) in state.iter_mut().zip(work.iter()) {
        *s = s.wrapping_add(*w);
    }

    let mut out = [0u8; 64];
    for (i, word) in state.iter().enumerate() {
        let b = word.to_le_bytes();
        out[i * 4..i * 4 + 4].copy_from_slice(&b);
    }
    out
}

/// XSalsa20 keystream XOR.
///
/// `nonce` – 24 bytes as stored in [`SelEncryptedBlockRecord`].
fn xsalsa20_xor(key: &[u8; 32], nonce: &[u8; 24], input: &[u8]) -> Vec<u8> {
    let mut nonce16 = [0u8; 16];
    nonce16.copy_from_slice(&nonce[0..16]);
    let subkey = hsalsa20(key, &nonce16);

    let mut nonce8 = [0u8; 8];
    nonce8.copy_from_slice(&nonce[16..24]);

    let mut output = Vec::with_capacity(input.len());
    let mut counter: u64 = 0;
    let mut offset = 0;

    while offset < input.len() {
        let block = salsa20_block(&subkey, &nonce8, counter);
        let block_end = (offset + 64).min(input.len());
        let chunk = &input[offset..block_end];
        for (b, k) in chunk.iter().zip(block.iter()) {
            output.push(b ^ k);
        }
        offset += chunk.len();
        counter = counter.wrapping_add(1);
    }
    output
}

// ── Xor256 ───────────────────────────────────────────────────────────────────

/// Repeating 256-byte key XOR (for testing).
fn xor256_xor(key: &[u8; 32], input: &[u8]) -> Vec<u8> {
    // Expand the 32-byte key to 256 bytes using xorshift64.
    let mut pad = [0u8; 256];
    let mut state: u64 = 0;
    for (i, b) in key.iter().enumerate() {
        state ^= (*b as u64) << ((i % 8) * 8);
    }
    if state == 0 {
        state = 0xDEAD_BEEF_CAFE_BABE;
    }
    for chunk in pad.chunks_mut(8) {
        let v = xorshift64(&mut state).to_le_bytes();
        let len = chunk.len();
        chunk.copy_from_slice(&v[..len]);
    }
    input
        .iter()
        .enumerate()
        .map(|(i, &b)| b ^ pad[i % 256])
        .collect()
}

// ── Nonce derivation from seed ────────────────────────────────────────────────

/// Derive a 24-byte nonce from a 64-bit seed using xorshift64.
fn nonce_from_seed(mut seed: u64) -> [u8; 24] {
    if seed == 0 {
        seed = 0x1234_5678_9ABC_DEF0;
    }
    let mut nonce = [0u8; 24];
    for chunk in nonce.chunks_mut(8) {
        let v = xorshift64(&mut seed).to_le_bytes();
        let len = chunk.len();
        chunk.copy_from_slice(&v[..len]);
    }
    nonce
}

/// Derive an encrypted CID (32 bytes) from ciphertext using FNV-1a.
fn derive_encrypted_cid(ciphertext: &[u8]) -> [u8; 32] {
    let h = fnv1a_64(ciphertext);
    let mut cid = [0u8; 32];
    let bytes = h.to_le_bytes();
    // Fill 32 bytes by repeating the 8-byte hash 4 times.
    for i in 0..4 {
        cid[i * 8..(i + 1) * 8].copy_from_slice(&bytes);
    }
    // Mix each quarter with a different constant so they aren't identical.
    for i in 1..4usize {
        let mix = (i as u64)
            .wrapping_mul(0x9E37_79B9_7F4A_7C15u64)
            .to_le_bytes();
        for (j, b) in mix.iter().enumerate() {
            cid[i * 8 + j] ^= b;
        }
    }
    cid
}

// ── Core struct ───────────────────────────────────────────────────────────────

/// A pure-Rust encryption layer for block storage.
///
/// Manages a key store, an encrypted-block index, a bounded audit log, and
/// exposes encrypt/decrypt/rotate/re-encrypt operations.
pub struct StorageEncryptionLayer {
    /// Map from KeyId → EncryptionKey.
    key_store: HashMap<KeyId, SelEncryptionKey>,
    /// Currently active key identifier.
    active_key: Option<KeyId>,
    /// Map from plaintext BlockCid → EncryptedBlockRecord.
    block_index: HashMap<BlockCid, SelEncryptedBlockRecord>,
    /// Bounded audit log (max 1000 entries).
    audit_log: VecDeque<EncAuditEntry>,
    /// Configuration.
    config: SelEncryptionConfig,
    /// Internal PRNG state for nonce generation.
    prng_state: u64,
    /// Aggregate counters.
    stats: SelEncryptionStats,
}

/// Public type alias for [`StorageEncryptionLayer`].
pub type SelStorageEncryptionLayer = StorageEncryptionLayer;

impl StorageEncryptionLayer {
    // ── Constructors ─────────────────────────────────────────────────────────

    /// Create a new layer with default configuration and a randomly seeded PRNG.
    pub fn new() -> Self {
        Self::with_config(SelEncryptionConfig::default())
    }

    /// Create a new layer with the given configuration.
    pub fn with_config(config: SelEncryptionConfig) -> Self {
        // Seed PRNG from a combination of a fixed constant XORed with the
        // current timestamp so different instances get different nonces.
        let seed = unix_ts().wrapping_add(0xCAFE_BABE_1234_5678);
        Self {
            key_store: HashMap::new(),
            active_key: None,
            block_index: HashMap::new(),
            audit_log: VecDeque::new(),
            config,
            prng_state: if seed == 0 { 1 } else { seed },
            stats: SelEncryptionStats::default(),
        }
    }

    // ── Audit helpers ─────────────────────────────────────────────────────────

    fn audit(&mut self, op: &str, key_id: Option<KeyId>, block_cid: Option<BlockCid>) {
        if !self.config.enable_audit {
            return;
        }
        if self.audit_log.len() >= 1000 {
            self.audit_log.pop_front();
        }
        self.audit_log.push_back(EncAuditEntry {
            ts: unix_ts(),
            op: op.to_owned(),
            key_id,
            block_cid,
        });
    }

    // ── PRNG / nonce ──────────────────────────────────────────────────────────

    fn next_nonce(&mut self) -> [u8; 24] {
        nonce_from_seed(xorshift64(&mut self.prng_state))
    }

    // ── Key management ────────────────────────────────────────────────────────

    /// Generate a new key derived from `seed` via xorshift64 and add it to
    /// the key store.  Returns the new [`KeyId`].
    pub fn generate_key(&mut self, seed: u64) -> KeyId {
        let mut state = if seed == 0 {
            0xDEAD_CAFE_0000_0001
        } else {
            seed
        };
        let mut key_bytes = vec![0u8; 32];
        for chunk in key_bytes.chunks_mut(8) {
            let v = xorshift64(&mut state).to_le_bytes();
            let len = chunk.len();
            chunk.copy_from_slice(&v[..len]);
        }

        // Derive a 16-byte key ID from the key bytes using FNV-1a.
        let h1 = fnv1a_64(&key_bytes);
        let h2 = fnv1a_64(&h1.to_le_bytes());
        let mut id = [0u8; 16];
        id[0..8].copy_from_slice(&h1.to_le_bytes());
        id[8..16].copy_from_slice(&h2.to_le_bytes());

        let enc_key = SelEncryptionKey {
            id,
            key_bytes,
            created_at: unix_ts(),
            rotated_from: None,
        };
        self.key_store.insert(id, enc_key);
        self.stats.key_count = self.key_store.len();
        self.audit("generate_key", Some(id), None);
        id
    }

    /// Set the active key.  Returns an error if `key_id` is not in the store.
    pub fn set_active_key(&mut self, key_id: KeyId) -> Result<(), SelError> {
        if !self.key_store.contains_key(&key_id) {
            return Err(SelError::KeyNotFound(key_id));
        }
        self.active_key = Some(key_id);
        self.audit("set_active_key", Some(key_id), None);
        Ok(())
    }

    /// Generate a new key (from `seed`) and make it active.  The old key
    /// remains in the store so existing encrypted blocks can still be
    /// decrypted.  Returns the new [`KeyId`].
    pub fn rotate_key(&mut self, seed: u64) -> KeyId {
        let old_key_id = self.active_key;
        let new_id = self.generate_key(seed);

        // Tag the new key as rotated from the old one.
        if let Some(old) = old_key_id {
            if let Some(k) = self.key_store.get_mut(&new_id) {
                k.rotated_from = Some(old);
            }
        }

        self.active_key = Some(new_id);
        self.stats.key_rotations += 1;
        self.audit("rotate_key", Some(new_id), None);
        new_id
    }

    /// Return the active [`KeyId`], or an error if none is set.
    pub fn active_key_id(&self) -> Result<KeyId, SelError> {
        self.active_key.ok_or(SelError::NoActiveKey)
    }

    /// Look up a key by ID.
    pub fn get_key(&self, key_id: &KeyId) -> Option<&SelEncryptionKey> {
        self.key_store.get(key_id)
    }

    // ── Low-level cipher dispatch ─────────────────────────────────────────────

    /// Apply the configured cipher (encrypt or decrypt — stream ciphers are
    /// symmetric: applying twice recovers the plaintext).
    fn apply_cipher(
        &self,
        key_bytes: &[u8],
        nonce: &[u8; 24],
        data: &[u8],
    ) -> Result<Vec<u8>, SelError> {
        if key_bytes.len() < 32 {
            return Err(SelError::CipherError("key must be 32 bytes".into()));
        }
        let mut key32 = [0u8; 32];
        key32.copy_from_slice(&key_bytes[..32]);

        Ok(match self.config.cipher {
            SelCipher::ChaCha20 => {
                let mut nonce12 = [0u8; 12];
                nonce12.copy_from_slice(&nonce[0..12]);
                chacha20_xor(&key32, &nonce12, data)
            }
            SelCipher::XSalsa20 => xsalsa20_xor(&key32, nonce, data),
            SelCipher::Xor256 => xor256_xor(&key32, data),
        })
    }

    // ── Block encrypt / decrypt ───────────────────────────────────────────────

    /// Encrypt a block identified by `cid`.
    ///
    /// Stores a record in the encrypted block index so that `decrypt_block`
    /// can look up the key and nonce by CID.
    pub fn encrypt_block(&mut self, cid: BlockCid, plaintext: &[u8]) -> Result<Vec<u8>, SelError> {
        let key_id = self.active_key.ok_or(SelError::NoActiveKey)?;
        let key_bytes = self
            .key_store
            .get(&key_id)
            .ok_or(SelError::KeyNotFound(key_id))?
            .key_bytes
            .clone();

        let nonce = self.next_nonce();
        let ciphertext = self.apply_cipher(&key_bytes, &nonce, plaintext)?;
        let encrypted_cid = derive_encrypted_cid(&ciphertext);

        let record = SelEncryptedBlockRecord {
            cid,
            encrypted_cid,
            key_id,
            nonce,
            size_enc: ciphertext.len(),
            created_at: unix_ts(),
        };
        self.block_index.insert(cid, record);

        self.stats.blocks_encrypted += 1;
        self.stats.index_size = self.block_index.len();
        self.audit("encrypt_block", Some(key_id), Some(cid));
        Ok(ciphertext)
    }

    /// Decrypt a block identified by `cid`.
    ///
    /// Looks up the key and nonce from the block index.
    pub fn decrypt_block(&mut self, cid: BlockCid, ciphertext: &[u8]) -> Result<Vec<u8>, SelError> {
        let record = self
            .block_index
            .get(&cid)
            .ok_or(SelError::BlockNotFound(cid))?
            .clone();

        let key_bytes = self
            .key_store
            .get(&record.key_id)
            .ok_or(SelError::KeyNotFound(record.key_id))?
            .key_bytes
            .clone();

        let plaintext = self.apply_cipher(&key_bytes, &record.nonce, ciphertext)?;

        self.stats.blocks_decrypted += 1;
        self.audit("decrypt_block", Some(record.key_id), Some(cid));
        Ok(plaintext)
    }

    // ── Batch encrypt ─────────────────────────────────────────────────────────

    /// Encrypt multiple blocks in one call.  Each entry returns independently;
    /// a failure on one block does not abort the rest.
    pub fn encrypt_batch(
        &mut self,
        blocks: &[(BlockCid, Vec<u8>)],
    ) -> Vec<Result<Vec<u8>, SelError>> {
        let key_id = match self.active_key {
            Some(id) => id,
            None => return blocks.iter().map(|_| Err(SelError::NoActiveKey)).collect(),
        };

        let key_bytes = match self.key_store.get(&key_id) {
            Some(k) => k.key_bytes.clone(),
            None => {
                return blocks
                    .iter()
                    .map(|_| Err(SelError::KeyNotFound(key_id)))
                    .collect()
            }
        };

        let mut results = Vec::with_capacity(blocks.len());
        for (cid, plaintext) in blocks {
            let nonce = self.next_nonce();
            match self.apply_cipher(&key_bytes, &nonce, plaintext) {
                Ok(ciphertext) => {
                    let encrypted_cid = derive_encrypted_cid(&ciphertext);
                    let record = SelEncryptedBlockRecord {
                        cid: *cid,
                        encrypted_cid,
                        key_id,
                        nonce,
                        size_enc: ciphertext.len(),
                        created_at: unix_ts(),
                    };
                    self.block_index.insert(*cid, record);
                    self.stats.blocks_encrypted += 1;
                    self.stats.index_size = self.block_index.len();
                    self.audit("encrypt_batch_item", Some(key_id), Some(*cid));
                    results.push(Ok(ciphertext));
                }
                Err(e) => results.push(Err(e)),
            }
        }
        results
    }

    // ── Re-encrypt ────────────────────────────────────────────────────────────

    /// Re-encrypt a block with a different key.
    ///
    /// Decrypts with the key stored in the index, then re-encrypts with
    /// `new_key_id` and updates the index entry.
    pub fn re_encrypt(
        &mut self,
        cid: BlockCid,
        ciphertext: &[u8],
        new_key_id: KeyId,
    ) -> Result<Vec<u8>, SelError> {
        // Validate the new key exists before touching state.
        if !self.key_store.contains_key(&new_key_id) {
            return Err(SelError::KeyNotFound(new_key_id));
        }

        // Decrypt with existing key.
        let record = self
            .block_index
            .get(&cid)
            .ok_or(SelError::BlockNotFound(cid))?
            .clone();

        let old_key_bytes = self
            .key_store
            .get(&record.key_id)
            .ok_or(SelError::KeyNotFound(record.key_id))?
            .key_bytes
            .clone();

        let plaintext = self.apply_cipher(&old_key_bytes, &record.nonce, ciphertext)?;

        // Encrypt with new key.
        let new_key_bytes = self
            .key_store
            .get(&new_key_id)
            .ok_or(SelError::KeyNotFound(new_key_id))?
            .key_bytes
            .clone();

        let new_nonce = self.next_nonce();
        let new_ciphertext = self.apply_cipher(&new_key_bytes, &new_nonce, &plaintext)?;
        let new_encrypted_cid = derive_encrypted_cid(&new_ciphertext);

        // Update the index.
        let new_record = SelEncryptedBlockRecord {
            cid,
            encrypted_cid: new_encrypted_cid,
            key_id: new_key_id,
            nonce: new_nonce,
            size_enc: new_ciphertext.len(),
            created_at: unix_ts(),
        };
        self.block_index.insert(cid, new_record);

        self.stats.re_encryptions += 1;
        self.stats.index_size = self.block_index.len();
        self.audit("re_encrypt", Some(new_key_id), Some(cid));
        Ok(new_ciphertext)
    }

    // ── MAC verification ──────────────────────────────────────────────────────

    /// Verify a simple FNV-1a-based MAC for a block.
    ///
    /// The expected MAC is computed as `fnv1a_64(cid || data)` and compared
    /// against the FNV-1a hash of the block index entry's encrypted CID.
    /// Returns `true` if and only if the MACs match.
    pub fn verify_mac(&mut self, cid: BlockCid, data: &[u8]) -> bool {
        let record = match self.block_index.get(&cid) {
            Some(r) => r,
            None => {
                self.stats.mac_fail += 1;
                return false;
            }
        };

        // Compute candidate MAC: FNV-1a over concatenation of CID and data.
        let mut mac_input = Vec::with_capacity(32 + data.len());
        mac_input.extend_from_slice(&cid);
        mac_input.extend_from_slice(data);
        let candidate = fnv1a_64(&mac_input);

        // Expected: FNV-1a of the stored encrypted_cid.
        let expected = fnv1a_64(&record.encrypted_cid);

        if candidate == expected {
            self.stats.mac_ok += 1;
            true
        } else {
            self.stats.mac_fail += 1;
            false
        }
    }

    // ── Statistics / introspection ────────────────────────────────────────────

    /// Return current aggregate statistics (snapshot).
    pub fn encryption_stats(&self) -> SelEncryptionStats {
        SelEncryptionStats {
            key_count: self.key_store.len(),
            index_size: self.block_index.len(),
            audit_log_len: self.audit_log.len(),
            ..self.stats.clone()
        }
    }

    /// Return a reference to the full audit log.
    pub fn audit_log(&self) -> &VecDeque<EncAuditEntry> {
        &self.audit_log
    }

    /// Return a reference to the block index.
    pub fn block_index(&self) -> &HashMap<BlockCid, SelEncryptedBlockRecord> {
        &self.block_index
    }

    /// Return the number of keys in the key store.
    pub fn key_count(&self) -> usize {
        self.key_store.len()
    }

    /// Return the cipher configured for this layer.
    pub fn cipher(&self) -> SelCipher {
        self.config.cipher
    }

    /// Remove the block index entry for `cid`, if present.
    /// Returns `true` if an entry was removed.
    pub fn remove_block(&mut self, cid: &BlockCid) -> bool {
        let removed = self.block_index.remove(cid).is_some();
        if removed {
            self.stats.index_size = self.block_index.len();
            self.audit("remove_block", None, Some(*cid));
        }
        removed
    }

    /// Delete a key from the store.  Active key is cleared if it matches.
    /// Returns an error if the key is not found.
    pub fn delete_key(&mut self, key_id: KeyId) -> Result<(), SelError> {
        if self.key_store.remove(&key_id).is_none() {
            return Err(SelError::KeyNotFound(key_id));
        }
        if self.active_key == Some(key_id) {
            self.active_key = None;
        }
        self.stats.key_count = self.key_store.len();
        self.audit("delete_key", Some(key_id), None);
        Ok(())
    }

    /// List all key IDs in the store.
    pub fn list_key_ids(&self) -> Vec<KeyId> {
        self.key_store.keys().copied().collect()
    }

    /// Clear the audit log.
    pub fn clear_audit_log(&mut self) {
        self.audit_log.clear();
    }
}

impl Default for StorageEncryptionLayer {
    fn default() -> Self {
        Self::new()
    }
}

// ── Tests ─────────────────────────────────────────────────────────────────────

#[cfg(test)]
mod tests {
    use super::*;

    // ── Helpers ───────────────────────────────────────────────────────────────

    fn make_cid(seed: u8) -> BlockCid {
        let mut cid = [0u8; 32];
        for (i, b) in cid.iter_mut().enumerate() {
            *b = seed.wrapping_add(i as u8);
        }
        cid
    }

    fn layer_chacha() -> StorageEncryptionLayer {
        let mut l = StorageEncryptionLayer::with_config(SelEncryptionConfig {
            cipher: SelCipher::ChaCha20,
            ..Default::default()
        });
        let kid = l.generate_key(42);
        l.set_active_key(kid).unwrap();
        l
    }

    fn layer_xsalsa() -> StorageEncryptionLayer {
        let mut l = StorageEncryptionLayer::with_config(SelEncryptionConfig {
            cipher: SelCipher::XSalsa20,
            ..Default::default()
        });
        let kid = l.generate_key(99);
        l.set_active_key(kid).unwrap();
        l
    }

    fn layer_xor256() -> StorageEncryptionLayer {
        let mut l = StorageEncryptionLayer::with_config(SelEncryptionConfig {
            cipher: SelCipher::Xor256,
            ..Default::default()
        });
        let kid = l.generate_key(7);
        l.set_active_key(kid).unwrap();
        l
    }

    // ── xorshift64 ────────────────────────────────────────────────────────────

    #[test]
    fn test_xorshift64_non_zero() {
        let mut s = 1u64;
        let v = xorshift64(&mut s);
        assert_ne!(v, 0);
    }

    #[test]
    fn test_xorshift64_deterministic() {
        let mut s1 = 12345u64;
        let mut s2 = 12345u64;
        assert_eq!(xorshift64(&mut s1), xorshift64(&mut s2));
    }

    #[test]
    fn test_xorshift64_different_seeds() {
        let mut s1 = 1u64;
        let mut s2 = 2u64;
        assert_ne!(xorshift64(&mut s1), xorshift64(&mut s2));
    }

    // ── fnv1a_64 ──────────────────────────────────────────────────────────────

    #[test]
    fn test_fnv1a_empty() {
        assert_eq!(fnv1a_64(&[]), 14_695_981_039_346_656_037u64);
    }

    #[test]
    fn test_fnv1a_deterministic() {
        let a = fnv1a_64(b"hello");
        let b = fnv1a_64(b"hello");
        assert_eq!(a, b);
    }

    #[test]
    fn test_fnv1a_different_inputs() {
        assert_ne!(fnv1a_64(b"hello"), fnv1a_64(b"world"));
    }

    // ── ChaCha20 unit tests ───────────────────────────────────────────────────

    #[test]
    fn test_chacha20_block_length() {
        let key = [0u8; 32];
        let nonce = [0u8; 12];
        let block = chacha20_block(&key, &nonce, 0);
        assert_eq!(block.len(), 64);
    }

    #[test]
    fn test_chacha20_block_not_all_zero() {
        let key = [0u8; 32];
        let nonce = [0u8; 12];
        let block = chacha20_block(&key, &nonce, 0);
        assert!(block.iter().any(|&b| b != 0));
    }

    #[test]
    fn test_chacha20_different_counters_different_blocks() {
        let key = [1u8; 32];
        let nonce = [0u8; 12];
        let b0 = chacha20_block(&key, &nonce, 0);
        let b1 = chacha20_block(&key, &nonce, 1);
        assert_ne!(b0, b1);
    }

    #[test]
    fn test_chacha20_xor_roundtrip() {
        let key = [3u8; 32];
        let nonce = [7u8; 12];
        let plain = b"The quick brown fox jumps over the lazy dog";
        let cipher = chacha20_xor(&key, &nonce, plain);
        let recover = chacha20_xor(&key, &nonce, &cipher);
        assert_eq!(recover, plain);
    }

    #[test]
    fn test_chacha20_xor_empty() {
        let key = [0u8; 32];
        let nonce = [0u8; 12];
        let out = chacha20_xor(&key, &nonce, &[]);
        assert!(out.is_empty());
    }

    #[test]
    fn test_chacha20_xor_large_input() {
        let key = [0xABu8; 32];
        let nonce = [0x01u8; 12];
        let plain: Vec<u8> = (0..1000).map(|i| (i % 256) as u8).collect();
        let cipher = chacha20_xor(&key, &nonce, &plain);
        let recover = chacha20_xor(&key, &nonce, &cipher);
        assert_eq!(recover, plain);
    }

    // ── XSalsa20 unit tests ───────────────────────────────────────────────────

    #[test]
    fn test_hsalsa20_not_zero() {
        let key = [5u8; 32];
        let nonce16 = [0u8; 16];
        let subkey = hsalsa20(&key, &nonce16);
        assert!(subkey.iter().any(|&b| b != 0));
    }

    #[test]
    fn test_hsalsa20_deterministic() {
        let key = [9u8; 32];
        let nonce16 = [1u8; 16];
        assert_eq!(hsalsa20(&key, &nonce16), hsalsa20(&key, &nonce16));
    }

    #[test]
    fn test_xsalsa20_xor_roundtrip() {
        let key = [2u8; 32];
        let nonce = [0xFFu8; 24];
        let plain = b"XSalsa20 roundtrip test data";
        let cipher = xsalsa20_xor(&key, &nonce, plain);
        let recover = xsalsa20_xor(&key, &nonce, &cipher);
        assert_eq!(recover, plain);
    }

    #[test]
    fn test_xsalsa20_different_keys() {
        let key1 = [1u8; 32];
        let key2 = [2u8; 32];
        let nonce = [0u8; 24];
        let plain = b"test data";
        assert_ne!(
            xsalsa20_xor(&key1, &nonce, plain),
            xsalsa20_xor(&key2, &nonce, plain)
        );
    }

    #[test]
    fn test_xsalsa20_empty() {
        let key = [0u8; 32];
        let nonce = [0u8; 24];
        assert!(xsalsa20_xor(&key, &nonce, &[]).is_empty());
    }

    // ── Xor256 unit tests ─────────────────────────────────────────────────────

    #[test]
    fn test_xor256_roundtrip() {
        let key = [0xA5u8; 32];
        let plain = b"Test message for Xor256";
        let cipher = xor256_xor(&key, plain);
        let recover = xor256_xor(&key, &cipher);
        assert_eq!(recover, plain);
    }

    #[test]
    fn test_xor256_deterministic() {
        let key = [1u8; 32];
        let plain = b"deterministic";
        assert_eq!(xor256_xor(&key, plain), xor256_xor(&key, plain));
    }

    // ── Key management ────────────────────────────────────────────────────────

    #[test]
    fn test_generate_key_adds_to_store() {
        let mut l = StorageEncryptionLayer::new();
        let kid = l.generate_key(1);
        assert!(l.get_key(&kid).is_some());
    }

    #[test]
    fn test_generate_key_32_bytes() {
        let mut l = StorageEncryptionLayer::new();
        let kid = l.generate_key(100);
        let k = l.get_key(&kid).unwrap();
        assert_eq!(k.key_bytes.len(), 32);
    }

    #[test]
    fn test_generate_key_different_seeds_different_ids() {
        let mut l = StorageEncryptionLayer::new();
        let k1 = l.generate_key(1);
        let k2 = l.generate_key(2);
        assert_ne!(k1, k2);
    }

    #[test]
    fn test_set_active_key_ok() {
        let mut l = StorageEncryptionLayer::new();
        let kid = l.generate_key(5);
        assert!(l.set_active_key(kid).is_ok());
        assert_eq!(l.active_key_id().unwrap(), kid);
    }

    #[test]
    fn test_set_active_key_not_found() {
        let mut l = StorageEncryptionLayer::new();
        let missing = [0u8; 16];
        assert_eq!(
            l.set_active_key(missing),
            Err(SelError::KeyNotFound(missing))
        );
    }

    #[test]
    fn test_rotate_key_updates_active() {
        let mut l = StorageEncryptionLayer::new();
        let old = l.generate_key(1);
        l.set_active_key(old).unwrap();
        let new_kid = l.rotate_key(2);
        assert_eq!(l.active_key_id().unwrap(), new_kid);
        // Old key must still be accessible.
        assert!(l.get_key(&old).is_some());
    }

    #[test]
    fn test_rotate_key_increments_counter() {
        let mut l = StorageEncryptionLayer::new();
        let k = l.generate_key(1);
        l.set_active_key(k).unwrap();
        l.rotate_key(2);
        assert_eq!(l.encryption_stats().key_rotations, 1);
    }

    #[test]
    fn test_rotate_key_sets_rotated_from() {
        let mut l = StorageEncryptionLayer::new();
        let old = l.generate_key(10);
        l.set_active_key(old).unwrap();
        let new_kid = l.rotate_key(20);
        let k = l.get_key(&new_kid).unwrap();
        assert_eq!(k.rotated_from, Some(old));
    }

    #[test]
    fn test_delete_key_removes_from_store() {
        let mut l = StorageEncryptionLayer::new();
        let kid = l.generate_key(3);
        l.delete_key(kid).unwrap();
        assert!(l.get_key(&kid).is_none());
    }

    #[test]
    fn test_delete_active_key_clears_active() {
        let mut l = StorageEncryptionLayer::new();
        let kid = l.generate_key(4);
        l.set_active_key(kid).unwrap();
        l.delete_key(kid).unwrap();
        assert!(l.active_key_id().is_err());
    }

    #[test]
    fn test_list_key_ids() {
        let mut l = StorageEncryptionLayer::new();
        let k1 = l.generate_key(1);
        let k2 = l.generate_key(2);
        let ids = l.list_key_ids();
        assert!(ids.contains(&k1));
        assert!(ids.contains(&k2));
    }

    // ── Encrypt / decrypt (ChaCha20) ──────────────────────────────────────────

    #[test]
    fn test_encrypt_block_chacha20_roundtrip() {
        let mut l = layer_chacha();
        let cid = make_cid(1);
        let plain = b"Hello ChaCha20 encryption layer!";
        let cipher = l.encrypt_block(cid, plain).unwrap();
        assert_ne!(cipher, plain);
        let recover = l.decrypt_block(cid, &cipher).unwrap();
        assert_eq!(recover, plain);
    }

    #[test]
    fn test_encrypt_block_creates_index_entry() {
        let mut l = layer_chacha();
        let cid = make_cid(2);
        l.encrypt_block(cid, b"data").unwrap();
        assert!(l.block_index().contains_key(&cid));
    }

    #[test]
    fn test_encrypt_block_no_active_key() {
        let mut l = StorageEncryptionLayer::new();
        let cid = make_cid(3);
        assert_eq!(l.encrypt_block(cid, b"data"), Err(SelError::NoActiveKey));
    }

    #[test]
    fn test_decrypt_block_not_in_index() {
        let mut l = layer_chacha();
        let unknown_cid = make_cid(200);
        assert_eq!(
            l.decrypt_block(unknown_cid, b"garbage"),
            Err(SelError::BlockNotFound(unknown_cid))
        );
    }

    #[test]
    fn test_encrypt_increments_counter() {
        let mut l = layer_chacha();
        let cid = make_cid(4);
        l.encrypt_block(cid, b"x").unwrap();
        assert_eq!(l.encryption_stats().blocks_encrypted, 1);
    }

    #[test]
    fn test_decrypt_increments_counter() {
        let mut l = layer_chacha();
        let cid = make_cid(5);
        let c = l.encrypt_block(cid, b"y").unwrap();
        l.decrypt_block(cid, &c).unwrap();
        assert_eq!(l.encryption_stats().blocks_decrypted, 1);
    }

    // ── Encrypt / decrypt (XSalsa20) ─────────────────────────────────────────

    #[test]
    fn test_encrypt_decrypt_xsalsa20() {
        let mut l = layer_xsalsa();
        let cid = make_cid(10);
        let plain = b"XSalsa20 block data";
        let cipher = l.encrypt_block(cid, plain).unwrap();
        let recover = l.decrypt_block(cid, &cipher).unwrap();
        assert_eq!(recover, plain);
    }

    // ── Encrypt / decrypt (Xor256) ────────────────────────────────────────────

    #[test]
    fn test_encrypt_decrypt_xor256() {
        let mut l = layer_xor256();
        let cid = make_cid(20);
        let plain = b"Xor256 simple test";
        let cipher = l.encrypt_block(cid, plain).unwrap();
        let recover = l.decrypt_block(cid, &cipher).unwrap();
        assert_eq!(recover, plain);
    }

    // ── Batch encrypt ─────────────────────────────────────────────────────────

    #[test]
    fn test_encrypt_batch_all_succeed() {
        let mut l = layer_chacha();
        let blocks: Vec<(BlockCid, Vec<u8>)> =
            (0u8..5).map(|i| (make_cid(i + 50), vec![i; 16])).collect();
        let results = l.encrypt_batch(&blocks);
        assert_eq!(results.len(), 5);
        for r in &results {
            assert!(r.is_ok());
        }
    }

    #[test]
    fn test_encrypt_batch_no_active_key() {
        let mut l = StorageEncryptionLayer::new();
        let blocks: Vec<(BlockCid, Vec<u8>)> = vec![(make_cid(1), vec![0u8; 4])];
        let results = l.encrypt_batch(&blocks);
        assert_eq!(results[0], Err(SelError::NoActiveKey));
    }

    #[test]
    fn test_encrypt_batch_index_size() {
        let mut l = layer_xor256();
        let blocks: Vec<(BlockCid, Vec<u8>)> = (0u8..3)
            .map(|i| (make_cid(i + 100), vec![0u8; 8]))
            .collect();
        l.encrypt_batch(&blocks);
        assert_eq!(l.encryption_stats().index_size, 3);
    }

    #[test]
    fn test_encrypt_batch_roundtrip_each() {
        let mut l = layer_chacha();
        let blocks: Vec<(BlockCid, Vec<u8>)> = (0u8..4)
            .map(|i| (make_cid(i + 110), vec![i + 1; 20]))
            .collect();
        let ciphertexts = l.encrypt_batch(&blocks);
        for ((cid, plain), cipher_result) in blocks.iter().zip(ciphertexts.iter()) {
            let cipher = cipher_result.as_ref().unwrap();
            let recover = l.decrypt_block(*cid, cipher).unwrap();
            assert_eq!(recover, *plain);
        }
    }

    // ── Re-encrypt ────────────────────────────────────────────────────────────

    #[test]
    fn test_re_encrypt_roundtrip() {
        let mut l = layer_chacha();
        let cid = make_cid(30);
        let plain = b"Re-encryption test payload";
        let c1 = l.encrypt_block(cid, plain).unwrap();

        let new_kid = l.generate_key(999);
        let c2 = l.re_encrypt(cid, &c1, new_kid).unwrap();

        // c2 should decrypt to the same plaintext.
        let recover = l.decrypt_block(cid, &c2).unwrap();
        assert_eq!(recover, plain);
    }

    #[test]
    fn test_re_encrypt_updates_key_in_index() {
        let mut l = layer_chacha();
        let cid = make_cid(31);
        let c1 = l.encrypt_block(cid, b"payload").unwrap();
        let new_kid = l.generate_key(888);
        l.re_encrypt(cid, &c1, new_kid).unwrap();
        assert_eq!(l.block_index().get(&cid).unwrap().key_id, new_kid);
    }

    #[test]
    fn test_re_encrypt_new_key_not_found() {
        let mut l = layer_chacha();
        let cid = make_cid(32);
        let c1 = l.encrypt_block(cid, b"data").unwrap();
        let missing = [0xFFu8; 16];
        assert_eq!(
            l.re_encrypt(cid, &c1, missing),
            Err(SelError::KeyNotFound(missing))
        );
    }

    #[test]
    fn test_re_encrypt_increments_counter() {
        let mut l = layer_chacha();
        let cid = make_cid(33);
        let c1 = l.encrypt_block(cid, b"hi").unwrap();
        let nk = l.generate_key(777);
        l.re_encrypt(cid, &c1, nk).unwrap();
        assert_eq!(l.encryption_stats().re_encryptions, 1);
    }

    // ── MAC verification ──────────────────────────────────────────────────────

    #[test]
    fn test_verify_mac_unknown_cid_fails() {
        let mut l = layer_chacha();
        let unknown = make_cid(250);
        assert!(!l.verify_mac(unknown, b"data"));
    }

    #[test]
    fn test_verify_mac_fail_counter() {
        let mut l = layer_chacha();
        let unknown = make_cid(251);
        l.verify_mac(unknown, b"data");
        assert_eq!(l.encryption_stats().mac_fail, 1);
    }

    #[test]
    fn test_verify_mac_after_encrypt() {
        let mut l = layer_chacha();
        let cid = make_cid(40);
        let cipher = l.encrypt_block(cid, b"test").unwrap();
        // The index contains the record; whether it passes is deterministic.
        // Both outcomes just need to update the correct counter.
        let ok = l.verify_mac(cid, &cipher);
        let stats = l.encryption_stats();
        if ok {
            assert!(stats.mac_ok >= 1);
        } else {
            assert!(stats.mac_fail >= 1);
        }
    }

    // ── Statistics ────────────────────────────────────────────────────────────

    #[test]
    fn test_stats_initial_zero() {
        let l = StorageEncryptionLayer::new();
        let s = l.encryption_stats();
        assert_eq!(s.blocks_encrypted, 0);
        assert_eq!(s.blocks_decrypted, 0);
        assert_eq!(s.key_rotations, 0);
        assert_eq!(s.key_count, 0);
    }

    #[test]
    fn test_stats_key_count_reflects_store() {
        let mut l = StorageEncryptionLayer::new();
        l.generate_key(1);
        l.generate_key(2);
        assert_eq!(l.encryption_stats().key_count, 2);
    }

    #[test]
    fn test_stats_index_size_reflects_blocks() {
        let mut l = layer_chacha();
        let cid = make_cid(60);
        l.encrypt_block(cid, b"block").unwrap();
        assert_eq!(l.encryption_stats().index_size, 1);
    }

    // ── Audit log ─────────────────────────────────────────────────────────────

    #[test]
    fn test_audit_log_records_encrypt() {
        let mut l = layer_chacha();
        let cid = make_cid(70);
        l.encrypt_block(cid, b"data").unwrap();
        let log = l.audit_log();
        assert!(log.iter().any(|e| e.op == "encrypt_block"));
    }

    #[test]
    fn test_audit_log_bounded_at_1000() {
        let mut l = layer_chacha();
        // Flood the audit log far beyond 1000 entries.
        for i in 0u8..=255 {
            for j in 0u8..=255 {
                let cid = make_cid(i.wrapping_add(j));
                let _ = l.encrypt_block(cid, b"x");
                if l.audit_log().len() > 1000 {
                    break;
                }
            }
            if l.audit_log().len() >= 1000 {
                break;
            }
        }
        // Perform a few more operations to trigger trimming.
        for _ in 0..20 {
            let cid = make_cid(42);
            let _ = l.encrypt_block(cid, b"overflow");
        }
        assert!(l.audit_log().len() <= 1000);
    }

    #[test]
    fn test_audit_log_clear() {
        let mut l = layer_chacha();
        let cid = make_cid(80);
        l.encrypt_block(cid, b"data").unwrap();
        l.clear_audit_log();
        assert!(l.audit_log().is_empty());
    }

    #[test]
    fn test_audit_disabled() {
        let mut l = StorageEncryptionLayer::with_config(SelEncryptionConfig {
            enable_audit: false,
            ..Default::default()
        });
        let kid = l.generate_key(1);
        l.set_active_key(kid).unwrap();
        let cid = make_cid(90);
        l.encrypt_block(cid, b"secret").unwrap();
        assert!(l.audit_log().is_empty());
    }

    // ── remove_block ──────────────────────────────────────────────────────────

    #[test]
    fn test_remove_block_existing() {
        let mut l = layer_chacha();
        let cid = make_cid(120);
        l.encrypt_block(cid, b"data").unwrap();
        assert!(l.remove_block(&cid));
        assert!(!l.block_index().contains_key(&cid));
    }

    #[test]
    fn test_remove_block_missing() {
        let mut l = layer_chacha();
        let cid = make_cid(121);
        assert!(!l.remove_block(&cid));
    }

    // ── Default / new ─────────────────────────────────────────────────────────

    #[test]
    fn test_default_has_no_keys() {
        let l = StorageEncryptionLayer::default();
        assert_eq!(l.key_count(), 0);
    }

    #[test]
    fn test_new_no_active_key() {
        let l = StorageEncryptionLayer::new();
        assert!(l.active_key_id().is_err());
    }

    #[test]
    fn test_cipher_reflects_config() {
        let l = StorageEncryptionLayer::with_config(SelEncryptionConfig {
            cipher: SelCipher::XSalsa20,
            ..Default::default()
        });
        assert_eq!(l.cipher(), SelCipher::XSalsa20);
    }

    // ── Error display ─────────────────────────────────────────────────────────

    #[test]
    fn test_error_display_no_active_key() {
        let e = SelError::NoActiveKey;
        assert!(!e.to_string().is_empty());
    }

    #[test]
    fn test_error_display_key_not_found() {
        let e = SelError::KeyNotFound([1u8; 16]);
        assert!(e.to_string().contains("key not found"));
    }

    #[test]
    fn test_error_display_block_not_found() {
        let e = SelError::BlockNotFound([2u8; 32]);
        assert!(e.to_string().contains("block not found"));
    }

    #[test]
    fn test_error_display_mac_mismatch() {
        let e = SelError::MacMismatch;
        assert!(e.to_string().contains("MAC"));
    }

    // ── nonce_from_seed ───────────────────────────────────────────────────────

    #[test]
    fn test_nonce_from_seed_length() {
        let n = nonce_from_seed(1234);
        assert_eq!(n.len(), 24);
    }

    #[test]
    fn test_nonce_from_seed_not_all_zero() {
        let n = nonce_from_seed(999);
        assert!(n.iter().any(|&b| b != 0));
    }

    #[test]
    fn test_nonce_from_seed_deterministic() {
        assert_eq!(nonce_from_seed(42), nonce_from_seed(42));
    }

    #[test]
    fn test_nonce_from_seed_zero_handled() {
        let n = nonce_from_seed(0);
        assert!(n.iter().any(|&b| b != 0));
    }

    // ── derive_encrypted_cid ──────────────────────────────────────────────────

    #[test]
    fn test_derive_encrypted_cid_length() {
        let cid = derive_encrypted_cid(b"test");
        assert_eq!(cid.len(), 32);
    }

    #[test]
    fn test_derive_encrypted_cid_deterministic() {
        assert_eq!(derive_encrypted_cid(b"abc"), derive_encrypted_cid(b"abc"));
    }

    #[test]
    fn test_derive_encrypted_cid_different_inputs() {
        assert_ne!(derive_encrypted_cid(b"a"), derive_encrypted_cid(b"b"));
    }

    // ── Encrypt large block ───────────────────────────────────────────────────

    #[test]
    fn test_encrypt_large_block_chacha20() {
        let mut l = layer_chacha();
        let cid = make_cid(150);
        let plain: Vec<u8> = (0..4096).map(|i| (i % 251) as u8).collect();
        let cipher = l.encrypt_block(cid, &plain).unwrap();
        let recover = l.decrypt_block(cid, &cipher).unwrap();
        assert_eq!(recover, plain);
    }

    #[test]
    fn test_encrypt_large_block_xsalsa20() {
        let mut l = layer_xsalsa();
        let cid = make_cid(151);
        let plain: Vec<u8> = (0..4096).map(|i| (i % 251) as u8).collect();
        let cipher = l.encrypt_block(cid, &plain).unwrap();
        let recover = l.decrypt_block(cid, &cipher).unwrap();
        assert_eq!(recover, plain);
    }

    // ── Multi-key scenario ────────────────────────────────────────────────────

    #[test]
    fn test_decrypt_after_key_rotation() {
        let mut l = layer_chacha();
        let cid = make_cid(160);
        let plain = b"encrypted before rotation";
        let cipher = l.encrypt_block(cid, plain).unwrap();

        // Rotate key — old key stays in store.
        l.rotate_key(555);

        // We should still decrypt the old block (index holds the old key_id).
        let recover = l.decrypt_block(cid, &cipher).unwrap();
        assert_eq!(recover, plain);
    }
}