import type {
  TBreakGlassEligibleGlobalCapability,
  TDelegableGlobalCapability,
} from '../data/authorization.js';
import type {
  TBreakGlassJustificationCode,
  TBreakGlassReviewOutcome,
} from '../data/user.js';

interface IBreakGlassAccessDtoBase {
  operationId: string;
  capabilities: TBreakGlassEligibleGlobalCapability[];
  justificationCode: TBreakGlassJustificationCode;
  requestedAt: number;
  approvalExpiresAt: number;
  activationDurationSeconds: number;
}

export type TBreakGlassAccessDto = IBreakGlassAccessDtoBase & (
  | { status: 'pending' }
  | {
      status: 'active' | 'expired';
      approvedAt: number;
      activeUntil: number;
      firstUsedAt: number | null;
    }
  | {
      status: 'reviewed';
      approvedAt: number;
      activeUntil: number;
      firstUsedAt: number | null;
      reviewedAt: number;
      reviewOutcome: TBreakGlassReviewOutcome;
    }
);

interface IAdministratorRecoveryDtoBase {
  operationId: string;
  requestedAt: number;
  approvalExpiresAt: number;
}

export type TAdministratorRecoveryDto = IAdministratorRecoveryDtoBase & (
  | { status: 'pending' }
  | {
      status: 'active' | 'expired';
      approvedAt: number;
      activeUntil: number;
    }
  | {
      status: 'completed';
      approvedAt: number;
      activeUntil: number;
      completedAt: number;
    }
);

export interface IUserDataDto {
  name: string;
  username: string;
  email: string;
  mobileNumber?: string;
  status: 'new' | 'active' | 'deleted' | 'suspended';
  connectedOrgs: string[];
  isGlobalAdmin?: boolean;
  globalCapabilities: TDelegableGlobalCapability[];
  /** Current public-safe break-glass state, without custody references. */
  breakGlassAccess?: TBreakGlassAccessDto | null;
  /** Current public-safe administrator-recovery state. */
  administratorRecovery?: TAdministratorRecoveryDto | null;
}

export interface IUserDto {
  id: string;
  data: IUserDataDto;
}

export interface ICurrentUserDto extends IUserDto {}

export interface IUserProfileDto {
  id: string;
  data: {
    name: string;
    username: string;
    email: string;
    mobileNumber?: string;
    status?: IUserDataDto['status'];
  };
}

/**
 * Platform-wide user summary for the global admin directory.
 * Never contains credentials, external identities, or SCIM internals.
 */
export interface IGlobalUserAdminDto {
  id: string;
  /** Exact current User revision for compare-and-set administration. */
  revision: number;
  name: string;
  username: string;
  email: string;
  status: IUserDataDto['status'];
  isGlobalAdmin: boolean;
  /** Sorted direct assignments; empty for global administrators. */
  globalCapabilities: TDelegableGlobalCapability[];
  /** Current public-safe break-glass request/grant/review state. */
  breakGlassAccess: TBreakGlassAccessDto | null;
  /** Current public-safe administrator-recovery state. */
  administratorRecovery: TAdministratorRecoveryDto | null;
  /** number of organizations the user belongs to */
  orgCount: number;
  /** epoch ms; derived for accounts created before this field existed */
  createdAt: number;
}