import type {
  TActivityAction,
  TActivityAuthenticationMethod,
  TActivityMembershipChange,
  TActivityMfaFactor,
  TActivityOidcTokenType,
  TActivityOutcome,
  TActivityReasonCode,
  TActivityRevocationScope,
  TActivityRoleChange,
  TActivitySessionKind,
  TActivityTargetType,
} from '../data/activity.js';
import type { TOAuthClientType } from '../data/app.js';

type TActivityEventFor<
  TAction extends TActivityAction,
  TTargetType extends TActivityTargetType,
  TFacts,
> = TAction extends TActivityAction
  ? {
      action: TAction;
      timestamp: number;
      outcome: TActivityOutcome;
      reasonCode?: TActivityReasonCode;
      targetType: TTargetType;
      facts: TFacts;
    }
  : never;

/**
 * Browser-safe activity event. The action field discriminates the union, so
 * every event has one fixed target type and only the explicitly allowlisted
 * facts for that action. Internal event identities, actors, target identities,
 * integrity data, delivery state, network data, and free text are excluded.
 */
export type TActivityEventDto =
  | TActivityEventFor<
      'login',
      'account',
      { authenticationMethod: TActivityAuthenticationMethod }
    >
  | TActivityEventFor<'logout', 'account', null>
  | TActivityEventFor<'session_created', 'session', { sessionKind: TActivitySessionKind }>
  | TActivityEventFor<
      'session_revoked',
      'session',
      { revocationScope: TActivityRevocationScope }
    >
  | TActivityEventFor<'passport_device_enrolled', 'passport_device', null>
  | TActivityEventFor<'passport_device_revoked', 'passport_device', null>
  | TActivityEventFor<'passport_challenge_approved', 'passport_challenge', null>
  | TActivityEventFor<'passport_challenge_rejected', 'passport_challenge', null>
  | TActivityEventFor<'org_created', 'organization', null>
  | TActivityEventFor<'org_updated', 'organization', null>
  | TActivityEventFor<'org_deleted', 'organization', null>
  | TActivityEventFor<'org_ownership_transferred', 'organization', null>
  | TActivityEventFor<'org_joined', 'organization_membership', null>
  | TActivityEventFor<'org_left', 'organization_membership', null>
  | TActivityEventFor<
      'role_changed',
      'organization_membership',
      { roleChange: TActivityRoleChange }
    >
  | TActivityEventFor<'org_app_role_mappings_updated', 'organization_role_mapping', null>
  | TActivityEventFor<'profile_updated', 'profile', null>
  | TActivityEventFor<'totp_enabled', 'mfa_method', null>
  | TActivityEventFor<'totp_disabled', 'mfa_method', null>
  | TActivityEventFor<'backup_codes_regenerated', 'mfa_method', null>
  | TActivityEventFor<'mfa_completed', 'mfa_method', { factor: TActivityMfaFactor }>
  | TActivityEventFor<'passkey_registered', 'passkey', null>
  | TActivityEventFor<'passkey_revoked', 'passkey', null>
  | TActivityEventFor<'passkey_login', 'passkey', null>
  | TActivityEventFor<'app_connected', 'application_connection', null>
  | TActivityEventFor<'app_disconnected', 'application_connection', null>
  | TActivityEventFor<'user_suspended', 'account', null>
  | TActivityEventFor<'user_unsuspended', 'account', null>
  | TActivityEventFor<'global_admin_granted', 'account', null>
  | TActivityEventFor<'global_admin_removed', 'account', null>
  | TActivityEventFor<'global_capabilities_changed', 'account', null>
  | TActivityEventFor<'break_glass_requested', 'break_glass_access', null>
  | TActivityEventFor<'break_glass_activated', 'break_glass_access', null>
  | TActivityEventFor<'break_glass_used', 'break_glass_access', null>
  | TActivityEventFor<'break_glass_reviewed', 'break_glass_access', null>
  | TActivityEventFor<
      'administrator_recovery_requested',
      'administrator_recovery',
      null
    >
  | TActivityEventFor<
      'administrator_recovery_activated',
      'administrator_recovery',
      null
    >
  | TActivityEventFor<
      'administrator_recovery_completed',
      'administrator_recovery',
      null
    >
  | TActivityEventFor<'account_deletion_requested', 'account', null>
  | TActivityEventFor<'account_deletion_cancelled', 'account', null>
  | TActivityEventFor<'account_purged', 'account', null>
  | TActivityEventFor<'sso_connection_created', 'sso_connection', { protocol: 'saml' }>
  | TActivityEventFor<'sso_connection_updated', 'sso_connection', { protocol: 'saml' }>
  | TActivityEventFor<'sso_connection_deleted', 'sso_connection', { protocol: 'saml' }>
  | TActivityEventFor<'sso_domain_verified', 'sso_domain', { protocol: 'saml' }>
  | TActivityEventFor<'sso_login', 'session', { protocol: 'saml' }>
  | TActivityEventFor<'scim_token_created', 'scim_token', null>
  | TActivityEventFor<'scim_token_revoked', 'scim_token', null>
  | TActivityEventFor<'scim_user_provisioned', 'scim_user', null>
  | TActivityEventFor<'scim_user_updated', 'scim_user', null>
  | TActivityEventFor<'scim_user_deactivated', 'scim_user', null>
  | TActivityEventFor<
      'scim_group_membership_changed',
      'scim_group_membership',
      { membershipChange: TActivityMembershipChange }
    >
  | TActivityEventFor<
      'oidc_authorization_granted',
      'oidc_authorization',
      { grantType: 'authorization_code' }
    >
  | TActivityEventFor<
      'oidc_code_exchanged',
      'oidc_token',
      { grantType: 'authorization_code' }
    >
  | TActivityEventFor<'oidc_refresh_rotated', 'oidc_token', { grantType: 'refresh_token' }>
  | TActivityEventFor<
      'oidc_refresh_reuse_detected',
      'oidc_token',
      { grantType: 'refresh_token' }
    >
  | TActivityEventFor<
      'oidc_token_revoked',
      'oidc_token',
      { tokenType: TActivityOidcTokenType }
    >
  | TActivityEventFor<
      'oidc_logout',
      'session',
      { revocationScope: TActivityRevocationScope }
    >
  | TActivityEventFor<'oidc_client_created', 'oidc_client', { clientType: TOAuthClientType }>
  | TActivityEventFor<'oidc_client_updated', 'oidc_client', { clientType: TOAuthClientType }>
  | TActivityEventFor<
      'oidc_client_activation_changed',
      'oidc_client',
      { clientType: TOAuthClientType; isActive: boolean }
    >
  | TActivityEventFor<'oidc_client_deleted', 'oidc_client', { clientType: TOAuthClientType }>
  | TActivityEventFor<
      'oidc_client_secret_rotated',
      'oidc_client',
      { clientType: 'confidential' }
    >
  | TActivityEventFor<'oidc_signing_key_rotated', 'oidc_signing_key', null>
  | TActivityEventFor<
      'oidc_lifecycle_revoked',
      'oidc_lifecycle',
      { revocationScope: TActivityRevocationScope }
    >
  | TActivityEventFor<'org_suspended', 'organization', null>
  | TActivityEventFor<'org_unsuspended', 'organization', null>;

type TAssertNoMissingActivityActions<TValue extends never> = TValue;
type TActivityEventDtoHasEveryAction = TAssertNoMissingActivityActions<
  Exclude<TActivityAction, TActivityEventDto['action']>
>;