class SecretContentDAO {

  public Optional<SecretContent> getSecretContentById(long id) {
    SecretsContentRecord r = dslContext.fetchOne(SECRETS_CONTENT, SECRETS_CONTENT.ID.eq(id));
    Optional<SecretContent> result = Optional.ofNullable(r).map(secretContentMapper::map);

    if (result.isEmpty()) {
      return result;
    }

    String rowHmac = rowHmacGenerator.computeRowHmac(
        SECRETS_CONTENT.getName(), List.of(r.getEncryptedContent(), r.getMetadata(), r.getId()));

    if (!rowHmac.equals(r.getRowHmac())) {
      String errorMessage = String.format(
          "Secret Content HMAC verification failed for secretContent: %d", r.getId());
      if (config.getRowHmacCheck() == RowHmacCheck.DISABLED_BUT_LOG) {
        logger.warn(errorMessage);
      }
      if (config.getRowHmacCheck() == RowHmacCheck.ENFORCED) {
        throw new AssertionError(errorMessage);
      }
    }

    return result;
  }

  private  SecretContentDAO(DSLContext dslContext, ObjectMapper mapper,
      SecretContentMapper secretContentMapper, RowHmacGenerator rowHmacGenerator,
      KeywhizConfig config);

}