/**
 * Push MFA approval types for SmartAuth Phase 5D.
 * Push approvals allow a logged-in auth app to approve/deny login attempts.
 */

import { z } from 'zod';

export interface PushApprovalDoc {
  id: string; // "pushappr_{random}"
  productId: string;
  userId: string;
  /** Which product triggered the login */
  requestProductId: string;
  /** Client platform that requested login */
  requestPlatform: string;
  /** IP of the login request */
  requestIp: string;
  /** Geo location (best effort) */
  requestGeo?: { country: string; city: string };
  status: 'pending' | 'approved' | 'denied' | 'expired';
  /** Challenge token for the pending login */
  challengeToken: string;
  createdAt: string;
  expiresAt: string;
  respondedAt?: string;
}

export const PushApprovalRespondSchema = z.object({
  action: z.enum(['approve', 'deny']),
});

export const PushApprovalCreateSchema = z.object({
  userId: z.string().min(1),
  requestProductId: z.string().min(1),
  requestPlatform: z.string().min(1),
  requestIp: z.string().default('unknown'),
  requestGeo: z
    .object({
      country: z.string(),
      city: z.string(),
    })
    .optional(),
  challengeToken: z.string().min(1),
});
