import * as plugins from './plugins.js';
import type { TControllerAuthState } from './interfaces.js';

export interface IReq_ControllerAuthState extends plugins.typedrequestInterfaces.implementsTR<
  plugins.typedrequestInterfaces.ITypedRequest,
  IReq_ControllerAuthState
> {
  method: 'controller.auth.state';
  request: Record<string, never>;
  response: {
    state: TControllerAuthState;
    authenticated: boolean;
    setupCodeExpired: boolean;
  };
}

export interface IReq_ControllerSetupBegin extends plugins.typedrequestInterfaces.implementsTR<
  plugins.typedrequestInterfaces.ITypedRequest,
  IReq_ControllerSetupBegin
> {
  method: 'controller.auth.setup.begin';
  request: {
    setupCode: string;
  };
  response: {
    ceremonyId: string;
    options: plugins.PublicKeyCredentialCreationOptionsJSON;
  };
}

export interface IReq_ControllerSetupFinish extends plugins.typedrequestInterfaces.implementsTR<
  plugins.typedrequestInterfaces.ITypedRequest,
  IReq_ControllerSetupFinish
> {
  method: 'controller.auth.setup.finish';
  request: {
    ceremonyId: string;
    setupCode: string;
    response: plugins.RegistrationResponseJSON;
  };
  response: {
    authenticated: true;
    /** single-use token to re-authenticate this browser after a reconnect */
    resumeToken: string;
    /** Unix milliseconds; the resume token stops working after this moment */
    resumeExpiresAt: number;
  };
}

export interface IReq_ControllerAuthenticationBegin extends plugins.typedrequestInterfaces.implementsTR<
  plugins.typedrequestInterfaces.ITypedRequest,
  IReq_ControllerAuthenticationBegin
> {
  method: 'controller.auth.authentication.begin';
  request: Record<string, never>;
  response: {
    ceremonyId: string;
    options: plugins.PublicKeyCredentialRequestOptionsJSON;
  };
}

export interface IReq_ControllerAuthenticationFinish extends plugins.typedrequestInterfaces.implementsTR<
  plugins.typedrequestInterfaces.ITypedRequest,
  IReq_ControllerAuthenticationFinish
> {
  method: 'controller.auth.authentication.finish';
  request: {
    ceremonyId: string;
    response: plugins.AuthenticationResponseJSON;
  };
  response: {
    authenticated: true;
    /** single-use token to re-authenticate this browser after a reconnect */
    resumeToken: string;
    /** Unix milliseconds; the resume token stops working after this moment */
    resumeExpiresAt: number;
  };
}

export interface IReq_ControllerTempPasswordLogin extends plugins.typedrequestInterfaces.implementsTR<
  plugins.typedrequestInterfaces.ITypedRequest,
  IReq_ControllerTempPasswordLogin
> {
  method: 'controller.auth.temppassword.login';
  request: {
    password: string;
  };
  response: {
    authenticated: true;
    /** Unix milliseconds; the credential stops working after this moment. */
    expiresAt: number;
    /** single-use token to re-authenticate this browser after a reconnect */
    resumeToken: string;
    /** Unix milliseconds; the resume token stops working after this moment */
    resumeExpiresAt: number;
  };
}

/**
 * Re-authenticates a fresh connection using a resume token minted by a prior
 * login on this browser. Tokens are single-use: a successful resume rotates
 * the token, so a stolen historical token cannot be replayed.
 */
export interface IReq_ControllerAuthResume extends plugins.typedrequestInterfaces.implementsTR<
  plugins.typedrequestInterfaces.ITypedRequest,
  IReq_ControllerAuthResume
> {
  method: 'controller.auth.resume';
  request: {
    token: string;
  };
  response: {
    authenticated: true;
    resumeToken: string;
    resumeExpiresAt: number;
  };
}