import * as data from '../data/index.js';
import * as dto from '../dto/index.js';
import * as plugins from '../plugins.js';

/**
 * List the SSO connections of an organization (org admin only)
 */
export interface IReq_GetSsoConnections
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_GetSsoConnections
  > {
  method: 'getSsoConnections';
  request: {
    jwt: string;
    organizationId: string;
  };
  response: {
    connections: dto.ISsoConnectionDto[];
  };
}

/**
 * Create an SSO connection for an organization (org admin only).
 * Either metadataXml or the manual idp fields must be provided.
 */
export interface IReq_CreateSsoConnection
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_CreateSsoConnection
  > {
  method: 'createSsoConnection';
  request: {
    jwt: string;
    organizationId: string;
    displayName: string;
    emailDomains: string[];
    /** IdP metadata XML; parsed server-side when provided */
    metadataXml?: string;
    /** Manual IdP configuration, used when metadataXml is absent */
    idp?: {
      entityId: string;
      ssoUrl: string;
      signingCertificates: string[];
    };
    provisioning: {
      mode: data.TSsoProvisioningMode;
      defaultOrgRoles: string[];
    };
    groupMappings?: data.IGroupRoleMapping[];
    attributeMapping?: data.ISsoAttributeMapping;
  };
  response: {
    connection: dto.ISsoConnectionDto;
    spDetails: dto.ISsoSpDetailsDto;
  };
}

/**
 * Update an SSO connection (org admin only). Only provided fields change.
 */
export interface IReq_UpdateSsoConnection
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_UpdateSsoConnection
  > {
  method: 'updateSsoConnection';
  request: {
    jwt: string;
    connectionId: string;
    displayName?: string;
    status?: 'active' | 'disabled';
    emailDomains?: string[];
    metadataXml?: string;
    idp?: {
      entityId: string;
      ssoUrl: string;
      signingCertificates: string[];
    };
    provisioning?: {
      mode: data.TSsoProvisioningMode;
      defaultOrgRoles: string[];
    };
    groupMappings?: data.IGroupRoleMapping[];
    attributeMapping?: data.ISsoAttributeMapping;
  };
  response: {
    connection: dto.ISsoConnectionDto;
  };
}

/**
 * Delete an SSO connection (org admin only)
 */
export interface IReq_DeleteSsoConnection
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_DeleteSsoConnection
  > {
  method: 'deleteSsoConnection';
  request: {
    jwt: string;
    connectionId: string;
  };
  response: {
    success: boolean;
  };
}

/**
 * Get the SP-side details (entityId, ACS URL, metadata URL, SCIM base URL)
 * an org admin needs to configure the customer IdP (org admin only)
 */
export interface IReq_GetSsoSpDetails
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_GetSsoSpDetails
  > {
  method: 'getSsoSpDetails';
  request: {
    jwt: string;
    connectionId: string;
  };
  response: {
    spDetails: dto.ISsoSpDetailsDto;
  };
}

/**
 * Check the DNS TXT ownership challenge for an SSO email domain (org admin only).
 * The domain must already be claimed by the specified connection.
 */
export interface IReq_VerifySsoDomain
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_VerifySsoDomain
  > {
  method: 'verifySsoDomain';
  request: {
    jwt: string;
    connectionId: string;
    domain: string;
  };
  response: {
    verified: boolean;
    connection: dto.ISsoConnectionDto;
  };
}

/**
 * Create a SCIM bearer token for an organization (org admin only).
 * The plaintext token is returned exactly once.
 */
export interface IReq_CreateScimToken
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_CreateScimToken
  > {
  method: 'createScimToken';
  request: {
    jwt: string;
    organizationId: string;
    label: string;
    /** Optional expiry timestamp (epoch ms) */
    expiresAt?: number;
  };
  response: {
    token: dto.IScimTokenDto;
    /** Plaintext bearer token; shown exactly once */
    plaintextToken: string;
  };
}

/**
 * List the SCIM tokens of an organization (org admin only)
 */
export interface IReq_GetScimTokens
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_GetScimTokens
  > {
  method: 'getScimTokens';
  request: {
    jwt: string;
    organizationId: string;
  };
  response: {
    tokens: dto.IScimTokenDto[];
  };
}

/**
 * Revoke a SCIM token (org admin only)
 */
export interface IReq_RevokeScimToken
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_RevokeScimToken
  > {
  method: 'revokeScimToken';
  request: {
    jwt: string;
    tokenId: string;
  };
  response: {
    success: boolean;
  };
}

/**
 * Public home-realm discovery: given an email address, reports whether an
 * active SSO connection covers its domain. Discloses domain-level presence
 * only (standard Okta-style HRD behavior); no account information.
 */
export interface IReq_DiscoverSsoForEmail
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_DiscoverSsoForEmail
  > {
  method: 'discoverSsoForEmail';
  request: {
    email: string;
  };
  response: {
    ssoAvailable: boolean;
    /** Relative login path to start the SAML flow when available */
    loginUrl?: string;
  };
}