/**
 * Device trust types for SmartAuth.
 *
 * Three trust levels:
 * - trusted (90d) — skip MFA
 * - remembered (30d) — pre-fill email
 * - unknown — full auth
 */

import { z } from 'zod';

export type DeviceTrustLevel = 'trusted' | 'remembered' | 'unknown';

export interface DeviceDoc {
  id: string; // "dev_{fingerprint}"
  userId: string;
  productId: 'smartauth';
  fingerprint: string;
  trustLevel: DeviceTrustLevel;
  /** Web: UA + screen + timezone; Native: model + OS + vendorUUID */
  deviceInfo: {
    userAgent?: string;
    platform?: string;
    model?: string;
    os?: string;
    screenResolution?: string;
    timezone?: string;
    language?: string;
  };
  lastIp?: string;
  lastLocation?: string;
  trustExpiresAt: string;
  createdAt: string;
  lastSeenAt: string;
}

export const TRUST_DURATIONS_DAYS: Record<DeviceTrustLevel, number> = {
  trusted: 90,
  remembered: 30,
  unknown: 0,
};

export const TrustDeviceSchema = z.object({
  fingerprint: z.string().min(1),
  trustLevel: z.enum(['trusted', 'remembered']),
  deviceInfo: z.record(z.string()).optional(),
});

export const DeviceFingerprintSchema = z.object({
  fingerprint: z.string().min(1),
});
