context(translationResult: TranslationResult, cryptoCatalog: CryptoCatalog)
fun dataEncryptedBeforePersisting(
    isSensitiveData: (Node) -> Boolean,
    isPersistentSink: (Node) -> Boolean,
    writtenData: (Node) -> List?
): QueryTree {
    return translationResult
        .allExtended(isPersistentSink) {
            val writtenData =
                writtenData(it)
                    ?: return@allExtended QueryTree(
                            value = true,
                            stringRepresentation = "Missing data written to a persistent location",
                            node = it,
                            operator = GenericQueryOperators.EVALUATE,
                        ) 
            writtenData
                .map { data -> data.alwaysCorrectlyEncrypted(isSensitiveData) }
                .mergeWithAll()
                .apply {
                    stringRepresentation =
                        if (value) "Data is always encrypted before being persisted to the sink."
                        else "Data is not always encrypted before being persisted to the sink."
                }
        }
        .apply {
            stringRepresentation =
                if (value)
                    "For each operation persisting data, the data is always encrypted with state of the art algorithms before being persisted."
                else
                    "For some operations persisting data, the data is not encrypted with state of the art algorithms before being persisted."
        }
}

context(cryptoCatalog: CryptoCatalog)
fun Node.alwaysCorrectlyEncrypted(
    isSensitiveData: (Node) -> Boolean
): QueryTree {
    val relevantEncryptOperations = mutableListOf()
    val writtenDataIsEncrypted =
        dataFlow(
            startNode = this,
            direction = Backward(GraphToFollow.DFG),
            type = Must,
            scope = Interprocedural(),
            predicate = { enc ->
                if (enc is Encrypt) {
                    relevantEncryptOperations.add(enc)
                    true
                } else if (!isSensitiveData(enc)) {
                    // Encryption is not necessary for insensitive data
                    true
                } else {
                    false
                }
            },
        )
            .apply {
                stringRepresentation =
                    if (value) "Data is always encrypted before being persisted."
                    else "Data is not always encrypted before being persisted."
            }

    val alwaysSotaEncryption =
        relevantEncryptOperations
            .map {
                // CipherOperation.concept is directly a Cipher
                (it.concept as? Cipher)?.conformsToStateOfTheArt()
                    ?: QueryTree(
                        value = false,
                        stringRepresentation =
                            "Missing Cipher concept related to an encryption operation.",
                        node = it,
                        operator = GenericQueryOperators.EVALUATE,
                    )
            }
            .mergeWithAll()
            .apply {
                stringRepresentation =
                    if (value)
                        "All usages of cryptographic algorithms are compliant with the state of the art."
                    else
                        "Some usages of cryptographic algorithms are not compliant with the state of the art."
            }

    // The data must be encrypted and the encryption must be state of the art
    return (writtenDataIsEncrypted and alwaysSotaEncryption).apply {
        stringRepresentation =
            if (value)
                "Data is always encrypted using state-of-the-art cryptographic algorithms before being persisted."
            else
                "Data is not always encrypted using state-of-the-art cryptographic algorithms before being persisted."
    }
}