/* eslint-disable no-unused-vars */
import type { AxiosResponse } from 'axios'

// ============================================
// Auth State & Events
// ============================================

export enum AuthState {
	LOGIN = 'login',
	LOGOUT = 'logout',
	SIGNUP = 'signup',
	PASSWORD_RESET = 'password_reset',
	PASSWORD_CHANGE = 'password_change',
	PROFILE_UPDATE = 'profile_update',
	AUTH_CHECK = 'auth_check',
	EMAIL_VERIFIED = 'email_verified',
	SESSION_REFRESH = 'session_refresh',
}

export type AuthEventHandler = () => void
export interface AuthEventMap {
	[AuthState.LOGIN]: AuthEventHandler
	[AuthState.LOGOUT]: AuthEventHandler
	[AuthState.SIGNUP]: AuthEventHandler
	[AuthState.PASSWORD_RESET]: AuthEventHandler
	[AuthState.PASSWORD_CHANGE]: AuthEventHandler
	[AuthState.PROFILE_UPDATE]: AuthEventHandler
	[AuthState.AUTH_CHECK]: AuthEventHandler
	[AuthState.EMAIL_VERIFIED]: AuthEventHandler
	[AuthState.SESSION_REFRESH]: AuthEventHandler
}

// ============================================
// Core Types
// ============================================

// Note: All accounts are "identity" accounts. An identity may be linked to a person or not.
export type AuthenticationAccountType = 'identity' | string

// ============================================
// Multi-Tenancy Types
// ============================================

export type TenantStatus = 'active' | 'suspended' | 'archived'

export interface TenantInfo {
	id: string
	name: string
	slug: string
	parent_id: string | null
	settings: Record<string, any> | null
	status: TenantStatus
	suspended_at: string | null
	suspended_reason: string | null
	created_at: string
	updated_at: string
}

export interface CreateTenantRequest {
	name: string
	slug?: string
	settings?: Record<string, any>
}

export interface UpdateTenantRequest {
	name?: string
	slug?: string
	settings?: Record<string, any>
	status?: TenantStatus
}

// ─── Tenant Membership ────────────────────────────────────────────────────────

export type MemberStatus = 'pending' | 'active' | 'inactive' | 'suspended'

export interface TenantMember {
	identity_id: string
	tenant_id: string
	roles: string[]
	status: MemberStatus
	metadata: Record<string, any> | null
	created_at: string
	updated_at: string
}

export interface AddMemberRequest {
	identity_id: string
	roles?: string[]
	status?: MemberStatus
}

export interface UpdateMemberRequest {
	roles?: string[]
	status?: MemberStatus
	metadata?: Record<string, any>
}

// ─── Invitations ──────────────────────────────────────────────────────────────

export type InvitationStatus = 'pending' | 'accepted' | 'expired' | 'revoked'

export interface TenantInvitation {
	id: string
	tenant_id: string
	email: string
	role: string
	status: InvitationStatus
	created_at: string
	expires_at: string | null
}

export interface CreateInvitationRequest {
	email: string
	role?: string
	message?: string
}

export interface AcceptInvitationRequest {
	first_name: string
	last_name: string
	password: string
}

// ─── Tenant API response types ────────────────────────────────────────────────

export type GetTenantsResponse = AxiosResponse<TenantInfo[]>
export type GetTenantResponse = AxiosResponse<TenantInfo>
export type CreateTenantResponse = AxiosResponse<TenantInfo>
export type UpdateTenantResponse = AxiosResponse<TenantInfo>
export type DeleteTenantResponse = AxiosResponse<MessageResponse>
export type GetTenantMembersResponse = AxiosResponse<TenantMember[]>
export type AddTenantMemberResponse = AxiosResponse<TenantMember>
export type UpdateTenantMemberResponse = AxiosResponse<TenantMember>
export type DeleteTenantMemberResponse = AxiosResponse<MessageResponse>
export type GetTenantRolesResponse = AxiosResponse<string[]>
export type CreateInvitationResponse = AxiosResponse<TenantInvitation>
export type GetInvitationResponse = AxiosResponse<{ email: string, first_name?: string | null, last_name?: string | null }>
export type AcceptInvitationResponse = AxiosResponse<MessageResponse>

export type AuthenticationMethodType
	= | 'password'
		| 'email_token'
		| 'email'
		| 'sso'
		| 'otp'
		| 'sms'
		| 'login_token'

export type SSOProvider = 'google' | 'microsoft' | 'github' | 'okta' | 'apple' | 'facebook' | 'custom'

export interface AuthenticationAccount {
	created_at?: string
	updated_at?: string
	account_type?: AuthenticationAccountType
	person_id?: string
	entity_id?: string
	display_name?: string
	is_active?: boolean
	is_verified?: boolean
	account_metadata?: string
	last_login_at?: string
	failed_login_attempts?: number
	locked_until?: string
	id: string
}

export interface PersonInfo {
	id: string
	name: string
	first_name: string
	last_name: string
	email?: string
	phone_number?: string
	tags: string[]
}

export interface AuthMethodInfo {
	id: string
	type: string
	identifier?: string
	is_verified: boolean
	last_used?: string
	use_count: number
	provider?: string
	provider_user_id?: string
}

export interface AccountInfo {
	id: string
	account_type: string
	display_name: string
	is_active: boolean
	is_verified: boolean
	last_login?: string
	roles: string[]
	authentication_methods: AuthMethodInfo[]
	person?: PersonInfo
}

// Note: EntityInfo kept for backward compatibility
// Current API no longer returns entity in AccountInfo
export interface EntityInfo {
	id: string
	name: string
	type?: string
	metadata?: Record<string, any>
}

export interface SessionInfo {
	id: string
	created_at: string
	expires_at: string
	ip_address?: string
	user_agent?: string
	is_current?: boolean
}

// ============================================
// Unified User Type (Person or Entity)
// ============================================

/**
 * Unified user representation
 * All accounts are "identity" accounts that may be linked to a person
 */
export interface User {
	/** Unique identifier (person_id if linked, otherwise identity_id) */
	id: string
	/** Identity/Account ID */
	accountId: string
	/** Display name */
	name: string
	/** Email address (from person or authentication methods) */
	email?: string
	/** Account type (always 'identity') */
	type: AuthenticationAccountType
	/** User roles (only when linked to person) */
	roles?: string[]
	/** Is the account active */
	isActive: boolean
	/** Is the account verified */
	isVerified: boolean
	/** Last login timestamp */
	lastLogin?: string
	/** Person info (if identity is linked to a person) */
	person?: PersonInfo
	/** Whether identity is linked to a person */
	hasPersonLinked: boolean
}

// ============================================
// Request Types
// ============================================

export interface RegisterRequest {
	email: string
	first_name: string
	last_name: string
	phone_number?: string
	password?: string
}

export interface UpdateAccountRequest {
	first_name?: string
	last_name?: string
	email?: string
	phone_number?: string
}

export interface PasswordLoginRequest {
	email: string
	password: string
}

export interface ChangePasswordRequest {
	current_password: string
	new_password: string
}

export interface ForgotPasswordRequest {
	email: string
}

export interface ResetPasswordRequest {
	token: string
	new_password: string
}

export interface SendVerificationRequest {
	email?: string
}

export interface VerifyEmailRequest {
	token: string
}

export interface EmailTokenSendRequest {
	email: string
}

export interface EmailTokenVerifyRequest {
	email: string
	token: string
}

export interface OTPSendRequest {
	phone_number: string
}

export interface OTPVerifyRequest {
	phone_number: string
	otp_code: string
	nonce: string
	verification_hash: string
	timestamp: number
}

/** @alias OTPSendRequest — renamed to SMSSendRequest in API v2 */
export type SMSSendRequest = OTPSendRequest

/** @alias OTPVerifyRequest — renamed to SMSVerifyRequest in API v2 */
export type SMSVerifyRequest = OTPVerifyRequest

// ─── Login Token Types ────────────────────────────────────────────────────────

export interface GenerateTokenRequest {
	target_identity_id?: string
	expires_in_minutes?: number
}

export interface GenerateTokenResponse {
	token: string
	target_identity_id: string
	issued_by: string
	expires_at: string
	expires_in_minutes: number
}

export interface RedeemTokenRequest {
	token: string
}

export interface SSOLoginRequest {
	provider: SSOProvider
	authorization_code?: string
	id_token?: string
	access_token?: string
}

// Client-side helper types
export interface NewUser extends RegisterRequest {
	confirmPassword: string
}

export interface UpdatePasswordForm extends ChangePasswordRequest {
	confirmNewPassword: string
}

// ============================================
// Response Types
// ============================================

export interface MessageResponse {
	message: string
}

export interface AuthStatusResponse {
	status: string
	methods: string[]
}

export interface AvailableMethodsResponse {
	available_methods: { [key: string]: any }[]
}

export interface OTPMetadata {
	nonce: string
	verification_hash: string
	timestamp: number
	expires_in_minutes: number
	autofill: { [key: string]: any }
}

export interface SSOMetadata {
	provider: string
	sso_user_info: { [key: string]: any }
	can_create_account?: boolean
}

export interface SSOInitiateRequest {
	redirect_uri?: string
	state: string
	scopes?: string[]
	params?: { [key: string]: any }
}

export interface SSOCallbackRequest {
	code: string
	state: string
}

export interface SSOLinkRequest {
	code: string
	state: string
}

export interface AuthenticationResponse {
	success: boolean
	account_id?: string
	session_token?: string
	requires_verification?: boolean
	verification_method?: AuthenticationMethodType
	message?: string
	metadata?: OTPMetadata | SSOMetadata | { [key: string]: any }
}

export interface SessionListResponse {
	account_id: string
	sessions: SessionInfo[]
}

// ============================================
// Axios Response Types
// ============================================

export type LoginResponse = AxiosResponse<AuthenticationResponse>
export type RegisterResponse = AxiosResponse<AuthenticationResponse>
export type LogoutResponse = AxiosResponse<MessageResponse>
export type GetMeResponse = AxiosResponse<AccountInfo>
export type UpdateMeResponse = AxiosResponse<AccountInfo>
export type DeleteMeResponse = AxiosResponse<MessageResponse>
export type GetAccountResponse = AxiosResponse<AccountInfo>
export type UpdateAccountResponse = AxiosResponse<AccountInfo>
export type DeleteAccountResponse = AxiosResponse<MessageResponse>
export type ActivateAccountResponse = AxiosResponse<AccountInfo>
export type DeactivateAccountResponse = AxiosResponse<AccountInfo>
export type ChangePasswordResponse = AxiosResponse<MessageResponse>
export type ForgotPasswordResponse = AxiosResponse<MessageResponse>
export type ResetPasswordResponse = AxiosResponse<MessageResponse>
export type VerifyResetTokenResponse = AxiosResponse<MessageResponse>
export type SendVerificationResponse = AxiosResponse<MessageResponse>
export type VerifyEmailResponse = AxiosResponse<MessageResponse>
export type RefreshSessionResponse = AxiosResponse<AuthenticationResponse>
export type GetSessionsResponse = AxiosResponse<SessionListResponse>
export type DeleteSessionResponse = AxiosResponse<MessageResponse>
export type DeleteAllSessionsResponse = AxiosResponse<MessageResponse>
export type CleanupSessionsResponse = AxiosResponse<MessageResponse>
export type GetMethodsResponse = AxiosResponse<AvailableMethodsResponse>
export interface SSOInitiateResponse {
	authorization_url: string
}
export interface SSOCallbackResponse {
	success: boolean
	account_id?: string
	session_token?: string
	requires_verification?: boolean
	metadata?: { [key: string]: any }
	message?: string
}
export interface SSOLinkResponse {
	success?: boolean
	message?: string
	provider?: string
	provider_user_id?: string
	email?: string
}
export interface SSOUnlinkResponse {
	success?: boolean
	message?: string
}
export type InitiateSSOResponse = AxiosResponse<SSOInitiateResponse>
export type CallbackSSOResponse = AxiosResponse<SSOCallbackResponse>
export type LinkSSOResponse = AxiosResponse<SSOLinkResponse>
export type UnlinkSSOResponse = AxiosResponse<SSOUnlinkResponse>
export type GetAuthStatusResponse = AxiosResponse<AuthStatusResponse>
export type SendEmailTokenResponse = AxiosResponse<AuthenticationResponse>
export type VerifyEmailTokenResponse = AxiosResponse<AuthenticationResponse>
export type SendOTPResponse = AxiosResponse<AuthenticationResponse>
export type VerifyOTPResponse = AxiosResponse<AuthenticationResponse>
export type SendSMSResponse = AxiosResponse<AuthenticationResponse>
export type VerifySMSResponse = AxiosResponse<AuthenticationResponse>
export type GenerateLoginTokenResponse = AxiosResponse<GenerateTokenResponse>
export type RedeemLoginTokenResponse = AxiosResponse<AuthenticationResponse>
export type LegacySSOLoginResponse = AxiosResponse<AuthenticationResponse>

// ============================================
// Helper Functions (exported for convenience)
// ============================================

/**
 * Extract unified user from account info
 * All accounts are identities that may be linked to a person
 */
export function accountToUser(account: AccountInfo | null): User | null {
	if (account === null) { return null }

	const hasPersonLinked = account.person !== undefined && account.person !== null

	// Identity linked to person - use person data
	if (hasPersonLinked) {
		return {
			id: account.person!.id,
			accountId: account.id,
			name: account.person!.name,
			email: account.person!.email,
			type: account.account_type as AuthenticationAccountType,
			roles: account.roles,
			isActive: account.is_active,
			isVerified: account.is_verified,
			person: account.person!,
			lastLogin: account.last_login,
			hasPersonLinked: true,
		}
	}

	// Identity without person link - extract data from authentication methods
	const emailMethod = account.authentication_methods.find(
		m => m.type === 'password' || m.type === 'email_token' || m.type === 'sso',
	)

	return {
		id: account.id,
		accountId: account.id,
		name: account.display_name,
		email: emailMethod?.identifier,
		type: account.account_type as AuthenticationAccountType,
		roles: account.roles,
		isActive: account.is_active,
		isVerified: account.is_verified,
		lastLogin: account.last_login,
		hasPersonLinked: false,
	}
}