import * as data from '../data/index.js';
import * as dto from '../dto/index.js';
import * as plugins from '../plugins.js';

export interface IReq_GetRolesAndOrganizationsForUserId
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_GetRolesAndOrganizationsForUserId
  > {
  method: 'getRolesAndOrganizationsForUserId';
  request: {
    jwt: string;
    userId: string;
  };
  response: {
    roles: dto.IRoleDto[];
    organizations: dto.IOrganizationDto[];
  };
}

export interface IReq_WhoIs
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_WhoIs
  > {
  method: 'whoIs';
  request: {
    jwt: string;
  };
  response: {
    user: dto.ICurrentUserDto;
  };
}

export interface IReq_GetUserSessions
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_GetUserSessions
  > {
  method: 'getUserSessions';
  request: {
    jwt: string;
  };
  response: {
    sessions: Array<{
      id: string;
      deviceId: string;
      deviceName: string;
      browser: string;
      os: string;
      ip: string;
      lastActive: number;
      createdAt: number;
      isCurrent: boolean;
    }>;
  };
}

export interface IReq_RevokeSession
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_RevokeSession
  > {
  method: 'revokeSession';
  request: {
    jwt: string;
    sessionId: string;
  };
  response: {
    success: boolean;
  };
}

/**
 * Self-service profile update. Email is deliberately NOT updatable here —
 * it is the account's login identifier and needs a verified-change flow.
 */
export interface IReq_UpdateProfile
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_UpdateProfile
  > {
  method: 'updateProfile';
  request: {
    jwt: string;
    name?: string;
    username?: string;
    mobileNumber?: string;
  };
  response: {
    user: dto.ICurrentUserDto;
  };
}

export interface IReq_GetUserActivity
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_GetUserActivity
  > {
  method: 'getUserActivity';
  request: {
    jwt: string;
    limit?: number;
    offset?: number;
  };
  response: {
    activities: dto.TActivityEventDto[];
    total: number;
  };
}

/**
 * Self-service account deletion. Requires password re-authentication.
 * Passwordless accounts fail closed until purpose-bound fresh-auth step-up is
 * available; typing an email address is never authentication. Owning any organization blocks deletion until ownership is
 * transferred or the organization is deleted. On success the account is
 * locked immediately (all sessions and JWTs revoked, sign-in rejected) and
 * purged after a 7-day grace window; a global admin can cancel within the
 * window by reactivating the account.
 */
export interface IReq_DeleteAccount
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_DeleteAccount
  > {
  method: 'deleteAccount';
  request: {
    jwt: string;
    /** required when the account has a password */
    password?: string;
    /** visual confirmation only; never accepted as authentication */
    confirmEmail?: string;
  };
  response: {
    success: boolean;
    /** epoch ms when the account will be purged */
    purgeAt: number;
  };
}

/**
 * Immediate, irreversible purge of a suspended account (global admin only).
 * The target must currently be suspended or in a pending-deletion state.
 */
export interface IReq_DeleteSuspendedUser
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_DeleteSuspendedUser
  > {
  method: 'deleteSuspendedUser';
  request: {
    jwt: string;
    userId: string;
  };
  response: {
    success: boolean;
  };
}

/**
 * Cursor-paged export of the authenticated user's full activity trail
 * (SOC2 audit evidence / data portability). Iterate until nextCursor is
 * absent.
 */
export interface IReq_ExportUserActivity
  extends plugins.typedRequestInterfaces.implementsTR<
    plugins.typedRequestInterfaces.ITypedRequest,
    IReq_ExportUserActivity
  > {
  method: 'exportUserActivity';
  request: {
    jwt: string;
    /** opaque cursor from the previous page */
    cursor?: string;
    /** page size, capped server-side */
    limit?: number;
    /** only events at or after this epoch ms */
    since?: number;
    /** only events at or before this epoch ms */
    until?: number;
  };
  response: {
    activities: dto.TActivityEventDto[];
    /** absent when the export is complete */
    nextCursor?: string;
  };
}