import { z } from "zod";
/**
 * Authentication Abstraction Interfaces
 *
 * These interfaces define the contracts for authentication-related operations.
 * Implementations can use different databases (PostgreSQL, MongoDB, etc.) to
 * store user, role, and token data.
 */
/**
 * User data structure
 */
export interface UserData {
    id: string;
    email: string;
    passwordHash?: string | null;
    displayName?: string | null;
    photoUrl?: string | null;
    emailVerified: boolean;
    emailVerificationToken?: string | null;
    emailVerificationSentAt?: Date | null;
    isAnonymous?: boolean;
    metadata?: Record<string, unknown>;
    createdAt: Date;
    updatedAt: Date;
}
/**
 * Data for creating a new user
 */
export interface CreateUserData {
    email: string;
    passwordHash?: string;
    displayName?: string;
    photoUrl?: string;
    emailVerified?: boolean;
    isAnonymous?: boolean;
    metadata?: Record<string, unknown>;
}
/**
 * User Identity Data (OAuth accounts linked to user)
 */
export interface UserIdentityData {
    id: string;
    userId: string;
    provider: string;
    providerId: string;
    profileData?: Record<string, unknown> | null;
    createdAt: Date;
    updatedAt: Date;
}
/**
 * Standardized profile data returned by an OAuth provider verification payload
 */
export interface OAuthProviderProfile {
    providerId: string;
    email: string;
    displayName?: string | null;
    photoUrl?: string | null;
    /** Whether the OAuth provider has verified the user's email address */
    emailVerified?: boolean;
}
/**
 * Pluggable OAuth Provider integration strategy
 */
export interface OAuthProvider<T = unknown> {
    /** The identifier of the provider (e.g. "github", "google") */
    id: string;
    /** Zod schema validating the expected request payload (e.g. { code: string }) */
    schema: z.ZodSchema<T>;
    /**
     * Verify external tokens/codes and return a standardized user profile.
     *
     * NOTE: Declared as method syntax (not arrow property) intentionally.
     * This makes `OAuthProvider` bivariant in `T`, which is correct because
     * each provider is self-contained — `schema` validates the request body
     * and `verify` consumes the same `T`. Bivariance lets heterogeneous
     * providers (`OAuthProvider<SpecificPayload>`) coexist in a single
     * `OAuthProvider<unknown>[]` array without resorting to `any`.
     */
    verify(payload: T): Promise<OAuthProviderProfile | null>;
}
/**
 * Role data structure
 */
export interface RoleData {
    id: string;
    name: string;
    isAdmin: boolean;
    defaultPermissions: {
        read?: boolean;
        create?: boolean;
        edit?: boolean;
        delete?: boolean;
    } | null;
    collectionPermissions: Record<string, {
        read?: boolean;
        create?: boolean;
        edit?: boolean;
        delete?: boolean;
    }> | null;
}
/**
 * Data for creating a new role
 */
export interface CreateRoleData {
    id: string;
    name: string;
    isAdmin?: boolean;
    defaultPermissions?: RoleData["defaultPermissions"];
    collectionPermissions?: RoleData["collectionPermissions"];
}
/**
 * Refresh token info
 */
export interface RefreshTokenInfo {
    id: string;
    userId: string;
    tokenHash: string;
    expiresAt: Date;
    createdAt: Date;
    userAgent?: string | null;
    ipAddress?: string | null;
}
/**
 * Password reset token info
 */
export interface PasswordResetTokenInfo {
    userId: string;
    expiresAt: Date;
}
/**
 * Magic link token info
 */
export interface MagicLinkTokenInfo {
    userId: string;
    expiresAt: Date;
}
/**
 * Options for paginated user listing
 */
export interface ListUsersOptions {
    /** Max results per page (default 25) */
    limit?: number;
    /** Number of results to skip (default 0) */
    offset?: number;
    /** Search term — matches against email and displayName (case-insensitive) */
    search?: string;
    /** Field to sort by (default "createdAt") */
    orderBy?: string;
    /** Sort direction (default "desc") */
    orderDir?: "asc" | "desc";
    /** Filter by role ID */
    roleId?: string;
}
/**
 * Result of a paginated user listing
 */
export interface PaginatedUsersResult {
    users: UserData[];
    /** Total number of users matching the filters (ignoring limit/offset) */
    total: number;
    limit: number;
    offset: number;
}
/**
 * Abstract user repository interface.
 * Handles all user-related database operations.
 */
export interface UserRepository {
    /**
     * Create a new user
     */
    createUser(data: CreateUserData): Promise<UserData>;
    /**
     * Get a user by ID
     */
    getUserById(id: string): Promise<UserData | null>;
    /**
     * Get a user by email
     */
    getUserByEmail(email: string): Promise<UserData | null>;
    /**
     * Get a user by an OAuth identity
     */
    getUserByIdentity(provider: string, providerId: string): Promise<UserData | null>;
    /**
     * Get all identities linked to a user
     */
    getUserIdentities(userId: string): Promise<UserIdentityData[]>;
    /**
     * Link a new OAuth identity to a user
     */
    linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
    /**
     * Update a user
     */
    updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
    /**
     * Delete a user
     */
    deleteUser(id: string): Promise<void>;
    /**
     * List all users (unbounded — use listUsersPaginated for large datasets)
     */
    listUsers(): Promise<UserData[]>;
    /**
     * List users with server-side pagination, search, and sorting.
     */
    listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
    /**
     * Update user's password hash
     */
    updatePassword(id: string, passwordHash: string): Promise<void>;
    /**
     * Set email verification status
     */
    setEmailVerified(id: string, verified: boolean): Promise<void>;
    /**
     * Set email verification token
     */
    setVerificationToken(id: string, token: string | null): Promise<void>;
    /**
     * Find user by email verification token
     */
    getUserByVerificationToken(token: string): Promise<UserData | null>;
    /**
     * Get roles for a user
     */
    getUserRoles(userId: string): Promise<RoleData[]>;
    /**
     * Get role IDs for a user
     */
    getUserRoleIds(userId: string): Promise<string[]>;
    /**
     * Set roles for a user (replaces existing roles)
     */
    setUserRoles(userId: string, roleIds: string[]): Promise<void>;
    /**
     * Assign a specific role to a new user
     */
    assignDefaultRole(userId: string, roleId: string): Promise<void>;
    /**
     * Get user with their roles
     */
    getUserWithRoles(userId: string): Promise<{
        user: UserData;
        roles: RoleData[];
    } | null>;
}
/**
 * Abstract role repository interface.
 * Handles all role-related database operations.
 */
export interface RoleRepository {
    /**
     * Get a role by ID
     */
    getRoleById(id: string): Promise<RoleData | null>;
    /**
     * List all roles
     */
    listRoles(): Promise<RoleData[]>;
    /**
     * Create a new role
     */
    createRole(data: CreateRoleData): Promise<RoleData>;
    /**
     * Update a role
     */
    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
    /**
     * Delete a role
     */
    deleteRole(id: string): Promise<void>;
}
/**
 * Abstract token repository interface.
 * Handles refresh tokens and password reset tokens.
 */
export interface TokenRepository {
    /**
     * Create a new refresh token
     */
    createRefreshToken(userId: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
    /**
     * Find a refresh token by hash
     */
    findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
    /**
     * Delete a refresh token by hash
     */
    deleteRefreshToken(tokenHash: string): Promise<void>;
    /**
     * Delete all refresh tokens for a user
     */
    deleteAllRefreshTokensForUser(userId: string): Promise<void>;
    /**
     * List all refresh tokens for a user
     */
    listRefreshTokensForUser(userId: string): Promise<RefreshTokenInfo[]>;
    /**
     * Delete a specific refresh token by its primary key ID
     */
    deleteRefreshTokenById(id: string, userId: string): Promise<void>;
    /**
     * Create a password reset token
     */
    createPasswordResetToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
    /**
     * Find a valid (not expired, not used) password reset token by hash
     */
    findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
    /**
     * Mark a password reset token as used
     */
    markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
    /**
     * Delete all password reset tokens for a user
     */
    deleteAllPasswordResetTokensForUser(userId: string): Promise<void>;
    /**
     * Clean up expired tokens
     */
    deleteExpiredTokens(): Promise<void>;
    /**
     * Create a magic link token
     */
    createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
    /**
     * Find a valid (not expired, not used) magic link token by hash
     */
    findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
    /**
     * Mark a magic link token as used
     */
    markMagicLinkTokenUsed(tokenHash: string): Promise<void>;
}
/**
 * MFA factor data structure
 */
export interface MfaFactor {
    id: string;
    userId: string;
    factorType: "totp";
    friendlyName?: string;
    verified: boolean;
    createdAt: Date;
    updatedAt: Date;
}
/**
 * MFA challenge information
 */
export interface MfaChallengeInfo {
    id: string;
    factorId: string;
    createdAt: Date;
    verifiedAt?: Date;
    ipAddress?: string;
}
/**
 * Recovery code data structure
 */
export interface RecoveryCode {
    id: string;
    userId: string;
    usedAt?: Date;
}
/**
 * Abstract MFA repository interface.
 * Handles all MFA-related database operations.
 */
export interface MfaRepository {
    /**
     * Create a new MFA factor for a user
     */
    createMfaFactor(userId: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
    /**
     * Get all MFA factors for a user
     */
    getMfaFactors(userId: string): Promise<MfaFactor[]>;
    /**
     * Get a specific MFA factor by ID
     */
    getMfaFactorById(factorId: string): Promise<(MfaFactor & {
        secretEncrypted: string;
    }) | null>;
    /**
     * Mark an MFA factor as verified
     */
    verifyMfaFactor(factorId: string): Promise<void>;
    /**
     * Delete an MFA factor
     */
    deleteMfaFactor(factorId: string, userId: string): Promise<void>;
    /**
     * Create an MFA challenge
     */
    createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
    /**
     * Get an MFA challenge by ID
     */
    getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
    /**
     * Mark an MFA challenge as verified
     */
    verifyMfaChallenge(challengeId: string): Promise<void>;
    /**
     * Create recovery codes for a user
     */
    createRecoveryCodes(userId: string, codeHashes: string[]): Promise<void>;
    /**
     * Use a recovery code (mark as used)
     */
    useRecoveryCode(userId: string, codeHash: string): Promise<boolean>;
    /**
     * Get unused recovery code count for a user
     */
    getUnusedRecoveryCodeCount(userId: string): Promise<number>;
    /**
     * Delete all recovery codes for a user
     */
    deleteAllRecoveryCodes(userId: string): Promise<void>;
    /**
     * Check if a user has any verified MFA factors
     */
    hasVerifiedMfaFactors(userId: string): Promise<boolean>;
}
/**
 * Combined auth repository interface for convenience
 */
export interface AuthRepository extends UserRepository, RoleRepository, TokenRepository, MfaRepository {
}