export interface BaseUser {
  email: string;
  name: string;
  role: string;
  [key: string]: unknown;
}

export interface AuthProviderInfo {
  provider: string;
  email: string;
  linkedAt: string;
  lastUsedAt: string | null;
}

export interface AuthContextValue<TUser extends BaseUser = BaseUser> {
  user: TUser | null;
  isAuthenticated: boolean;
  isLoading: boolean;
  error: string | null;
  success: string | null;
  login: (email: string, password: string) => Promise<boolean>;
  register: (email: string, password: string, displayName: string) => Promise<boolean>;
  logout: () => void;
  forgotPassword: (email: string) => Promise<boolean>;
  changePassword: (currentPassword: string, newPassword: string) => Promise<boolean>;
  deleteAccount: (password: string) => Promise<boolean>;
  updateUser: (updates: Partial<TUser>) => void;
  clearMessages: () => void;

  // ── SmartAuth: Social login (Phase 1C) ────────────
  loginWithGoogle: (idToken: string) => Promise<boolean>;
  loginWithMicrosoft: (idToken: string) => Promise<boolean>;
  loginWithApple: (idToken: string) => Promise<boolean>;

  // ── SmartAuth: Provider management (Phase 1C) ─────
  providers: AuthProviderInfo[];
  linkProvider: (provider: string, idToken: string) => Promise<boolean>;
  unlinkProvider: (provider: string) => Promise<boolean>;
  refreshProviders: () => Promise<void>;

  // ── SmartAuth: MFA state (Phase 2D) ───────────────
  mfaRequired: boolean;
  mfaMethods: string[];
  mfaChallenge: string | null;
  verifyMfa: (code: string, method: 'totp' | 'recovery') => Promise<boolean>;
}

export interface LoginResult<TUser extends BaseUser = BaseUser> {
  user: TUser;
  accessToken: string;
  refreshToken: string;
}

export interface AuthConfig<TUser extends BaseUser = BaseUser> {
  /** Base URL for auth API calls. Default: '/api'. */
  baseUrl?: string;
  /** Product identifier sent with OAuth requests. */
  productId?: string;
  storagePrefix: string;
  loginEndpoint: string;
  registerEndpoint?: string;
  forgotPasswordEndpoint?: string;
  changePasswordEndpoint?: string;
  deleteAccountEndpoint?: string;
  refreshEndpoint?: string;
  /** Token refresh interval in ms. Default: 45 * 60 * 1000 (45 minutes). */
  refreshIntervalMs?: number;
  mapLoginResponse: (data: unknown) => LoginResult<TUser>;
  onLoginFallback?: (
    email: string,
    password: string,
    error: string
  ) => Promise<LoginResult<TUser> | null>;
  /** Called once on mount to provide an initial session (e.g. from SSO cookies). Return null to fall through to localStorage. */
  onInit?: () => LoginResult<TUser> | null;
  onLogout?: () => void;

  // ── SmartAuth endpoint config (Phase 1C+) ─────────
  /** Endpoint for OAuth social login. Default: '/auth/oauth'. Provider appended as path segment. */
  oauthEndpoint?: string;
  /** Endpoint for listing providers. Default: '/auth/providers'. */
  providersEndpoint?: string;
  /** Endpoint for linking a provider. Default: '/auth/providers/link'. */
  linkProviderEndpoint?: string;
  /** Endpoint for MFA verification. Default: '/auth/mfa/verify'. */
  mfaVerifyEndpoint?: string;
  /** Callback when MFA is required after login. Receives challenge token and methods. */
  onMfaRequired?: (challenge: string, methods: string[]) => void;
}
