/**
 * Login event types for SmartAuth — audit trail + risk scoring.
 */

import { z } from 'zod';

export type LoginEventResult = 'success' | 'failed' | 'locked' | 'mfa_required' | 'mfa_failed';
export type LoginEventMethod =
  | 'password'
  | 'oauth_google'
  | 'oauth_microsoft'
  | 'oauth_apple'
  | 'passkey'
  | 'refresh';
export type RiskLevel = 'low' | 'medium' | 'high' | 'critical';

export interface LoginEventDoc {
  id: string;
  userId: string;
  productId: string;
  result: LoginEventResult;
  method: LoginEventMethod;
  riskLevel: RiskLevel;
  riskScore: number; // 0-100
  ip: string;
  userAgent?: string;
  fingerprint?: string;
  location?: string;
  /** Flags that contributed to risk score */
  riskFlags: string[];
  createdAt: string;
}

export const LoginEventQuerySchema = z.object({
  userId: z.string().optional(),
  result: z.enum(['success', 'failed', 'locked', 'mfa_required', 'mfa_failed']).optional(),
  limit: z.coerce.number().int().min(1).max(100).default(50),
  since: z.string().optional(),
});
