/**
 * Auth types — consolidates 3 JWT implementations (Python backend, TS admin, TS user).
 */

import { z } from 'zod';

// ── OneAuth: Product Membership ──────────────────────────────

export interface ProductMembership {
  productId: string;
  plan: 'free' | 'pro' | 'enterprise';
  role: 'super_admin' | 'admin' | 'viewer' | 'user';
  firstAccessAt: string;
  subscriptionId?: string;
  licenseId?: string;
}

export interface UserDoc {
  id: string;
  productId: string;
  email: string;
  passwordHash: string;
  plan: 'free' | 'pro' | 'enterprise';
  role: 'super_admin' | 'admin' | 'viewer' | 'user';
  displayName: string;
  status: 'active' | 'disabled';
  emailVerified: boolean;
  lastLoginAt: string | null;
  createdAt: string;
  updatedAt: string;
  phone?: string | null;
  bio?: string | null;
  avatarUrl?: string | null;
  // ── OneAuth fields ────────────────────────────────────────
  primaryProductId?: string;
  memberships?: ProductMembership[];
  mfaEnabled?: boolean;
  mfaMethods?: string[];
  lockedUntil?: string | null;
  failedLoginAttempts?: number;
}

// ── OneAuth: Auth Provider (linked OAuth identities) ────────

export interface AuthProviderDoc {
  id: string; // "{userId}:{provider}"
  productId: 'smartauth';
  userId: string;
  provider: string; // 'google' | 'microsoft' | 'apple'
  providerUserId: string;
  email: string;
  displayName?: string;
  linkedAt: string;
  lastUsedAt: string;
}

export interface TokenPayload {
  sub: string;
  email: string;
  role: string;
  productId: string;
  plan?: 'free' | 'pro' | 'enterprise';
  iat: number;
  exp: number;
}

export const LoginSchema = z.object({
  email: z.string().email(),
  password: z.string().min(1),
  productId: z.string().min(1),
});

export const RegisterSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
  displayName: z.string().min(1),
  role: z.enum(['admin', 'viewer', 'user']).default('user'),
  productId: z.string().min(1),
});

export const RefreshSchema = z.object({
  refreshToken: z.string().min(1),
});

export const UpdateUserSchema = z.object({
  displayName: z.string().min(1).optional(),
  role: z.enum(['super_admin', 'admin', 'viewer', 'user']).optional(),
  plan: z.enum(['free', 'pro', 'enterprise']).optional(),
  status: z.enum(['active', 'disabled']).optional(),
});

export const SsoLoginSchema = z.object({
  email: z.string().email(),
  productId: z.string().min(1),
  provider: z.enum(['microsoft', 'google']),
  displayName: z.string().min(1).optional(),
});

export const ProfileUpdateSchema = z.object({
  displayName: z.string().min(1).optional(),
  phone: z.string().optional().nullable(),
  bio: z.string().optional().nullable(),
  avatarUrl: z.string().url().optional().nullable(),
});

export type LoginInput = z.infer<typeof LoginSchema>;
export type RegisterInput = z.infer<typeof RegisterSchema>;
export type UpdateUserInput = z.infer<typeof UpdateUserSchema>;
export type SsoLoginInput = z.infer<typeof SsoLoginSchema>;
export type ProfileUpdateInput = z.infer<typeof ProfileUpdateSchema>;

// ── Password Change (authenticated) ─────────────────────────

export const ChangePasswordSchema = z.object({
  currentPassword: z.string().min(1),
  newPassword: z.string().min(8),
});

// ── Delete Account (authenticated) ──────────────────────────

export const DeleteAccountSchema = z.object({
  password: z.string().min(1),
});

// ── Password Reset ───────────────────────────────────────────

export const ForgotPasswordSchema = z.object({
  email: z.string().email(),
  productId: z.string().min(1),
});

export const ResetPasswordSchema = z.object({
  token: z.string().min(1),
  newPassword: z.string().min(8),
});

export interface PasswordResetTokenDoc {
  id: string;
  productId: string;
  userId: string;
  tokenHash: string;
  expiresAt: string;
  usedAt?: string;
  createdAt: string;
}

// ── Email Verification ───────────────────────────────────────

export const VerifyEmailSchema = z.object({
  token: z.string().min(1),
});

export const ResendVerificationSchema = z.object({
  email: z.string().email(),
  productId: z.string().min(1),
});

export interface EmailVerificationDoc {
  id: string;
  productId: string;
  userId: string;
  email: string;
  tokenHash: string;
  expiresAt: string;
  verifiedAt?: string;
  createdAt: string;
}
