/**
 * Palantir Foundry Admin API.
 * Users, groups, organizations, marks.
 *
 * User management: getCurrentUser, getUser, listUsers, deactivateUser, reactivateUser.
 * Organizations: get, list, create, replace.
 *
 * @see https://www.palantir.com/docs/foundry/api/v2/admin-v2-resources/
 */

import type { PalantirClient } from "./client.js";
import type { User, PageResponse, PageParams } from "./types.js";

/** A Foundry organization. */
export interface Organization {
  rid: string;
  name: string;
  description?: string;
  host?: string;
  markingId?: string;
}

/** A Foundry group. */
export interface Group {
  rid: string;
  displayName: string;
  description?: string;
  memberCount?: number;
}

/** Parameters for creating an organization. */
export interface CreateOrganizationParams {
  enrollmentRid: string;
  administrators: PrincipalId[];
  displayName?: string;
  description?: string;
  host?: string;
}

/** A principal identifier for admin operations. */
export interface PrincipalId {
  id: string;
  type: "USER" | "GROUP";
}

/** Parameters for searching users. */
export interface SearchUsersParams {
  query?: string;
  groupId?: string[];
  pageSize?: number;
  pageToken?: string;
}

export class AdminNamespace {
  constructor(private client: PalantirClient) {}

  // ─── Users ──────────────────────────────────────────────────────

  /** Get the currently authenticated user. */
  async getCurrentUser(params?: { preview?: boolean }): Promise<User> {
    return this.client.get("/api/v2/admin/users/getCurrent", params as Record<string, unknown>);
  }

  /** Get a user by ID. */
  async getUser(userId: string): Promise<User> {
    return this.client.get(`/api/v2/admin/users/${userId}`);
  }

  /** Search users by query. */
  async searchUsers(params?: SearchUsersParams): Promise<PageResponse<User>> {
    return this.client.post("/api/v2/admin/users/search", params);
  }

  /** List users. */
  async listUsers(params?: PageParams & { groupId?: string }): Promise<PageResponse<User>> {
    return this.client.get("/api/v2/admin/users", params as Record<string, unknown>);
  }

  /** Deactivate a user. */
  async deactivateUser(userId: string): Promise<User> {
    return this.client.post(`/api/v2/admin/users/${userId}/deactivate`);
  }

  /** Reactivate a previously deactivated user. */
  async reactivateUser(userId: string): Promise<User> {
    return this.client.post(`/api/v2/admin/users/${userId}/reactivate`);
  }

  /** Revoke all tokens for a user. */
  async revokeAllTokens(userId: string): Promise<void> {
    return this.client.post(`/api/v2/admin/users/${userId}/revokeAllTokens`);
  }

  // ─── Groups ─────────────────────────────────────────────────────

  /** Get a group by ID. */
  async getGroup(groupId: string): Promise<Group> {
    return this.client.get(`/api/v2/admin/groups/${groupId}`);
  }

  /** List groups. */
  async listGroups(params?: PageParams): Promise<PageResponse<Group>> {
    return this.client.get("/api/v2/admin/groups", params);
  }

  // ─── Organizations ──────────────────────────────────────────────

  /** Get an organization by RID. */
  async getOrganization(organizationRid: string): Promise<Organization> {
    return this.client.get(`/api/v2/admin/organizations/${organizationRid}`);
  }

  /** List organizations. */
  async listOrganizations(params?: PageParams): Promise<PageResponse<Organization>> {
    return this.client.get("/api/v2/admin/organizations", params);
  }

  /** Create a new organization. */
  async createOrganization(params: CreateOrganizationParams): Promise<Organization> {
    return this.client.post("/api/v2/admin/organizations", params);
  }

  /** Replace (update) an organization. */
  async replaceOrganization(
    organizationRid: string,
    params: CreateOrganizationParams
  ): Promise<Organization> {
    return this.client.put(`/api/v2/admin/organizations/${organizationRid}`, params);
  }

  /** List available roles for an organization. */
  async listAvailableRoles(organizationRid: string): Promise<unknown> {
    return this.client.get(`/api/v2/admin/organizations/${organizationRid}/listAvailableRoles`);
  }

  /** Add role assignments to an organization. Requires preview=true. */
  async addRoleAssignments(
    organizationRid: string,
    params: { roleAssignments: Array<{ principal: PrincipalId; role: string }> }
  ): Promise<void> {
    return this.client.post(
      `/api/v2/admin/organizations/${organizationRid}/roleAssignments/add?preview=true`,
      params
    );
  }

  // ─── Marks ──────────────────────────────────────────────────────

  /** List all marks (audit marks). */
  async listMarks(params?: PageParams): Promise<PageResponse<unknown>> {
    return this.client.get("/api/v2/admin/marks", params);
  }
}