/**
 * Enterprise SSO provisioning mode for a connection.
 * - jit: accounts are created just-in-time on first SAML login
 * - scim-only: accounts must be provisioned via SCIM before they can sign in
 * - jit-and-scim: both paths are allowed
 */
export type TSsoProvisioningMode = 'jit' | 'scim-only' | 'jit-and-scim';

export type TSsoDomainVerificationStatus = 'pending' | 'verified';

/**
 * DNS TXT ownership proof for one email domain claimed by an SSO connection.
 * The TXT challenge is public material and may be shown to organization admins.
 */
export interface ISsoDomainVerification {
  domain: string;
  status: TSsoDomainVerificationStatus;
  dnsTxtName: string;
  dnsTxtValue: string;
  createdAt: number;
  lastCheckedAt?: number;
  verifiedAt?: number;
}

/**
 * Maps an IdP-side group name to org roles on idp.global.
 * Used both for SAML group attributes and SCIM group memberships.
 */
export interface IGroupRoleMapping {
  /** Group name as sent by the customer IdP (SAML attribute value or SCIM group displayName) */
  idpGroup: string;
  /** Org roles granted while the user is a member of the group */
  orgRoles: string[];
}

/**
 * Optional SAML attribute name overrides. Sensible defaults are applied
 * when unset (NameID for email, standard claim URIs for name/groups).
 */
export interface ISsoAttributeMapping {
  email?: string;
  name?: string;
  groups?: string;
}

/**
 * An org-level enterprise SSO connection. idp.global acts as the SAML
 * service provider; the customer org brings their own IdP (Okta, Entra, ...).
 */
export interface ISsoConnection {
  id: string;
  data: {
    organizationId: string;
    /** Connection protocol. Only SAML for now; OIDC federation may follow. */
    type: 'saml';
    displayName: string;
    status: 'active' | 'disabled';
    /**
     * Email domains claimed by this connection. Claims are globally unique,
     * but only verified claims may enable home-realm discovery or SAML login.
     */
    emailDomains: string[];
    idp: {
      /** IdP entityID from metadata */
      entityId: string;
      /** IdP single-sign-on URL (HTTP-Redirect binding) */
      ssoUrl: string;
      /**
       * IdP signing certificates (PEM). Multiple entries allow zero-downtime
       * certificate rollover on the customer side.
       */
      signingCertificates: string[];
      /** Raw uploaded metadata XML, kept for re-parsing and debugging */
      metadataXml?: string;
    };
    provisioning: {
      mode: TSsoProvisioningMode;
      /** Org roles granted to every user of this connection */
      defaultOrgRoles: string[];
    };
    groupMappings: IGroupRoleMapping[];
    attributeMapping?: ISsoAttributeMapping;
    createdAt: number;
    updatedAt: number;
  };
}

/**
 * Authoritative globally unique email-domain claim. This is persisted
 * separately from the SSO connection so concurrent claims cannot race.
 */
export interface ISsoDomainClaim {
  id: string;
  data: ISsoDomainVerification & {
    organizationId: string;
    connectionId: string;
  };
}

/**
 * Internal persisted SCIM bearer token record. Never return this shape to
 * clients; the plaintext token is shown exactly once at creation.
 */
export interface IScimTokenRecord {
  id: string;
  data: {
    organizationId: string;
    /** Human-readable label, e.g. "Okta production" */
    label: string;
    /** sha256 hash of the bearer token */
    tokenHash: string;
    /** First characters of the token for display purposes */
    tokenPrefix: string;
    createdAt: number;
    expiresAt?: number;
    lastUsedAt?: number;
    revoked: boolean;
  };
  /** Monotonic lifecycle revision used by exact no-upsert persistence. */
  revision: number;
}