/**
 * MFA types for SmartAuth — TOTP setup, recovery codes, challenge tokens.
 */

import { z } from 'zod';

export interface MfaDoc {
  id: string; // "mfa_{userId}"
  userId: string;
  productId: 'smartauth';
  method: 'totp';
  /** AES-256-GCM encrypted TOTP secret */
  encryptedSecret: string;
  /** IV for AES-256-GCM (hex) */
  iv: string;
  /** Auth tag for AES-256-GCM (hex) */
  authTag: string;
  /** SHA-256 hashed recovery codes (8 codes, single-use) */
  recoveryCodes: string[];
  verified: boolean;
  enabledAt?: string;
  createdAt: string;
  updatedAt: string;
}

export interface MfaPolicyDoc {
  id: string; // "mfapol_{productId}"
  productId: string;
  required: boolean;
  methods: string[]; // ['totp']
  gracePeriodDays: number; // days before enforcement
  createdAt: string;
  updatedAt: string;
}

export const MfaSetupSchema = z.object({});

export const MfaVerifySetupSchema = z.object({
  code: z.string().length(6),
});

export const MfaVerifySchema = z.object({
  challengeToken: z.string().min(1),
  code: z.string().min(6).max(8), // 6-digit TOTP or 8-char recovery code
});

export const MfaDisableSchema = z.object({
  code: z.string().min(6).max(8),
});

export const MfaPolicySchema = z.object({
  required: z.boolean(),
  methods: z.array(z.string()).default(['totp']),
  gracePeriodDays: z.number().int().min(0).default(7),
});
