import * as plugins from '../plugins.js';
import { type TOidcScope } from '../data/index.js';

export interface IReq_CompleteOidcAuthorization
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_CompleteOidcAuthorization
  > {
  method: 'completeOidcAuthorization';
  request: {
    jwt: string;
    clientId: string;
    redirectUri: string;
    scope: string;
    state: string;
    prompt?: 'none' | 'login' | 'consent';
    codeChallenge: string;
    codeChallengeMethod: 'S256';
    nonce?: string;
    consentApproved?: boolean;
  };
  response: {
    code: string;
    redirectUrl: string;
  };
}

export interface IReq_PrepareOidcAuthorization
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_PrepareOidcAuthorization
  > {
  method: 'prepareOidcAuthorization';
  request: {
    jwt: string;
    clientId: string;
    redirectUri: string;
    scope: string;
    state: string;
    prompt?: 'none' | 'login' | 'consent';
    codeChallenge: string;
    codeChallengeMethod: 'S256';
    nonce?: string;
  };
  response: {
    status: 'ready' | 'consent_required';
    clientId: string;
    appName: string;
    appUrl: string;
    logoUrl?: string;
    requestedScopes: TOidcScope[];
    grantedScopes: TOidcScope[];
  };
}

/**
 * Opaque authorization handoff. The browser receives only the one-time
 * transaction identifier; all OAuth request data remains server-side.
 */
export interface IReq_InspectOidcAuthorizationV2
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_InspectOidcAuthorizationV2
  > {
  method: 'inspectOidcAuthorizationV2';
  request: {
    transactionId: string;
  };
  response: {
    prompt: 'none' | 'login' | 'consent' | null;
  };
}

export interface IReq_PrepareOidcAuthorizationV2
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_PrepareOidcAuthorizationV2
  > {
  method: 'prepareOidcAuthorizationV2';
  request: {
    jwt: string;
    transactionId: string;
  };
  response: IReq_PrepareOidcAuthorization['response'];
}

export interface IReq_CompleteOidcAuthorizationV2
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_CompleteOidcAuthorizationV2
  > {
  method: 'completeOidcAuthorizationV2';
  request: {
    jwt: string;
    transactionId: string;
    consentApproved?: boolean;
  };
  response: {
    redirectUrl: string;
  };
}

export interface IReq_DenyOidcAuthorizationV2
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_DenyOidcAuthorizationV2
  > {
  method: 'denyOidcAuthorizationV2';
  request: {
    transactionId: string;
    error?: 'access_denied' | 'login_required' | 'consent_required';
  };
  response: {
    redirectUrl: string;
  };
}