import { Secrets } from "@1password/sdk"
import * as z from "zod"
import { defineAction } from "../../automation/actions"
import {
  getOnePasswordClient,
  getOnePasswordEventsApi,
  onePasswordEventsAccountOptions,
  ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS,
} from "./lib"
import {
  ONEPASSWORD_AUDIT_EVENT_PAGE_SCHEMA,
  ONEPASSWORD_DOCUMENT_CREATE_SCHEMA,
  ONEPASSWORD_ENVIRONMENT_VARIABLES_SCHEMA,
  ONEPASSWORD_EVENTS_CURSOR_SCHEMA,
  ONEPASSWORD_EVENTS_INTROSPECTION_SCHEMA,
  ONEPASSWORD_FILE_ATTRIBUTES_SCHEMA,
  ONEPASSWORD_FILE_CREATE_SCHEMA,
  ONEPASSWORD_GROUP_ACCESS_SCHEMA,
  ONEPASSWORD_GROUP_GET_PARAMS_SCHEMA,
  ONEPASSWORD_GROUP_OUTPUT_SCHEMA,
  ONEPASSWORD_GROUP_VAULT_ACCESS_SCHEMA,
  ONEPASSWORD_ITEM_CREATE_SCHEMA,
  ONEPASSWORD_ITEM_LIST_FILTER_SCHEMA,
  ONEPASSWORD_ITEM_OUTPUT_SCHEMA,
  ONEPASSWORD_ITEM_OVERVIEW_SCHEMA,
  ONEPASSWORD_ITEM_SCHEMA,
  ONEPASSWORD_ITEM_SHARE_PARAMS_SCHEMA,
  ONEPASSWORD_ITEM_SHARE_POLICY_OUTPUT_SCHEMA,
  ONEPASSWORD_ITEM_SHARE_POLICY_SCHEMA,
  ONEPASSWORD_ITEMS_DELETE_ALL_RESPONSE_SCHEMA,
  ONEPASSWORD_ITEMS_GET_ALL_RESPONSE_SCHEMA,
  ONEPASSWORD_ITEMS_UPDATE_ALL_RESPONSE_SCHEMA,
  ONEPASSWORD_ITEM_USAGE_PAGE_SCHEMA,
  ONEPASSWORD_PASSWORD_RECIPE_SCHEMA,
  ONEPASSWORD_RESOLVE_ALL_RESPONSE_SCHEMA,
  ONEPASSWORD_SIGN_IN_ATTEMPT_PAGE_SCHEMA,
  ONEPASSWORD_VALID_RECIPIENT_SCHEMA,
  ONEPASSWORD_VAULT_CREATE_SCHEMA,
  ONEPASSWORD_VAULT_GET_PARAMS_SCHEMA,
  ONEPASSWORD_VAULT_LIST_PARAMS_SCHEMA,
  ONEPASSWORD_VAULT_OVERVIEW_SCHEMA,
  ONEPASSWORD_VAULT_SCHEMA,
  ONEPASSWORD_VAULT_UPDATE_SCHEMA,
} from "./schemas"

const EMPTY_OUTPUT_SCHEMA = z.object({})
const ITEM_ID_INPUT_SCHEMA = z.object({
  /** Unique item ID. */
  itemId: z.string().min(1),

  /** Unique vault ID containing the item. */
  vaultId: z.string().min(1),
})

/** Resolves one 1Password secret reference such as `op://vault/item/field`. */
export const resolveOnePasswordSecret = defineAction("Resolve 1Password secret")
  .describe("Resolves one secret reference with a connected service account.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      /** Secret reference URI to resolve. */
      secretReference: z.string().startsWith("op://"),
    }),
  )
  .output(z.string(), { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).secrets.resolve(
      input.secretReference,
    ),
  )

/** Resolves several 1Password secret references independently. */
export const resolveOnePasswordSecrets = defineAction(
  "Resolve 1Password secrets",
)
  .describe("Resolves several references and returns per-reference results.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      /** Distinct secret reference URIs to resolve. */
      secretReferences: z.string().startsWith("op://").array().min(1),
    }),
  )
  .output(ONEPASSWORD_RESOLVE_ALL_RESPONSE_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).secrets.resolveAll(
      input.secretReferences,
    ),
  )

/** Generates a password locally with the official 1Password SDK. */
export const generateOnePasswordPassword = defineAction(
  "Generate 1Password password",
)
  .describe("Generates a memorable password, PIN, or random password locally.")
  .input(z.object({ recipe: ONEPASSWORD_PASSWORD_RECIPE_SCHEMA }))
  .output(z.object({ password: z.string().min(1) }), { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(({ input }) => Secrets.generatePassword(input.recipe))

/** Creates one item in a vault available to the service account. */
export const createOnePasswordItem = defineAction("Create 1Password item")
  .describe("Creates one item with fields, sections, websites, and files.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(z.object({ item: ONEPASSWORD_ITEM_CREATE_SCHEMA }))
  .output(ONEPASSWORD_ITEM_OUTPUT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.create(input.item),
  )

const CREATE_ITEMS_INPUT_SCHEMA = z
  .object({
    /** Items to create in the selected vault. */
    items: ONEPASSWORD_ITEM_CREATE_SCHEMA.array().min(1),

    /** Unique vault ID receiving every item. */
    vaultId: z.string().min(1),
  })
  .refine(
    ({ items, vaultId }) => items.every((item) => item.vaultId === vaultId),
    { message: "Every item vaultId must match the batch vaultId." },
  )

/** Creates several items within one 1Password vault. */
export const createOnePasswordItems = defineAction("Create 1Password items")
  .describe("Creates a batch of items in one vault with per-item results.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(CREATE_ITEMS_INPUT_SCHEMA)
  .output(ONEPASSWORD_ITEMS_UPDATE_ALL_RESPONSE_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.createAll(
      input.vaultId,
      input.items,
    ),
  )

/** Retrieves one decrypted 1Password item. */
export const getOnePasswordItem = defineAction("Get 1Password item")
  .describe("Retrieves one decrypted item by vault and item ID.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(ITEM_ID_INPUT_SCHEMA)
  .output(ONEPASSWORD_ITEM_OUTPUT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.get(
      input.vaultId,
      input.itemId,
    ),
  )

/** Retrieves several decrypted items from one 1Password vault. */
export const getOnePasswordItems = defineAction("Get 1Password items")
  .describe("Retrieves several items by ID with per-item results.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      /** Unique item IDs to retrieve. */
      itemIds: z.string().min(1).array().min(1),

      /** Unique vault ID containing every item. */
      vaultId: z.string().min(1),
    }),
  )
  .output(ONEPASSWORD_ITEMS_GET_ALL_RESPONSE_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.getAll(
      input.vaultId,
      input.itemIds,
    ),
  )

/** Replaces one 1Password item using its current version. */
export const updateOnePasswordItem = defineAction("Update 1Password item")
  .describe("Updates a complete item and enforces 1Password version checks.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(z.object({ item: ONEPASSWORD_ITEM_SCHEMA }))
  .output(ONEPASSWORD_ITEM_OUTPUT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.put(input.item),
  )

/** Permanently deletes one 1Password item. */
export const deleteOnePasswordItem = defineAction("Delete 1Password item")
  .describe("Permanently deletes one item by vault and item ID.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(ITEM_ID_INPUT_SCHEMA)
  .output(EMPTY_OUTPUT_SCHEMA)
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) => {
    await (
      await getOnePasswordClient(account)
    ).items.delete(input.vaultId, input.itemId)
    return {}
  })

/** Permanently deletes several items from one 1Password vault. */
export const deleteOnePasswordItems = defineAction("Delete 1Password items")
  .describe("Deletes several items and returns a result for each item ID.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      /** Unique item IDs to delete. */
      itemIds: z.string().min(1).array().min(1),

      /** Unique vault ID containing every item. */
      vaultId: z.string().min(1),
    }),
  )
  .output(ONEPASSWORD_ITEMS_DELETE_ALL_RESPONSE_SCHEMA)
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.deleteAll(
      input.vaultId,
      input.itemIds,
    ),
  )

/** Moves one 1Password item into the vault archive. */
export const archiveOnePasswordItem = defineAction("Archive 1Password item")
  .describe("Archives one item by vault and item ID.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(ITEM_ID_INPUT_SCHEMA)
  .output(EMPTY_OUTPUT_SCHEMA)
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) => {
    await (
      await getOnePasswordClient(account)
    ).items.archive(input.vaultId, input.itemId)
    return {}
  })

/** Lists active or archived item overviews in one 1Password vault. */
export const listOnePasswordItems = defineAction("List 1Password items")
  .describe("Lists item overviews in one vault with optional state filters.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      /** SDK item-list filters applied in order. */
      filters: ONEPASSWORD_ITEM_LIST_FILTER_SCHEMA.array().optional(),

      /** Unique vault ID to list. */
      vaultId: z.string().min(1),
    }),
  )
  .output(ONEPASSWORD_ITEM_OVERVIEW_SCHEMA.array(), { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.list(
      input.vaultId,
      ...(input.filters ?? []),
    ),
  )

/** Attaches a file field to an existing 1Password item. */
export const attachOnePasswordItemFile = defineAction(
  "Attach 1Password item file",
)
  .describe("Attaches binary file content to a section field on an item.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      file: ONEPASSWORD_FILE_CREATE_SCHEMA,
      item: ONEPASSWORD_ITEM_SCHEMA,
    }),
  )
  .output(ONEPASSWORD_ITEM_OUTPUT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.files.attach(
      input.item,
      input.file,
    ),
  )

/** Reads binary content from a file attached to a 1Password item. */
export const readOnePasswordItemFile = defineAction("Read 1Password item file")
  .describe("Reads one attached file by its item and file attributes.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      /** File attributes returned on the decrypted item. */
      file: ONEPASSWORD_FILE_ATTRIBUTES_SCHEMA,

      /** Unique item ID containing the file. */
      itemId: z.string().min(1),

      /** Unique vault ID containing the item. */
      vaultId: z.string().min(1),
    }),
  )
  .output(z.instanceof(Uint8Array), { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(
    async ({ account, input }) =>
      new Uint8Array(
        await (
          await getOnePasswordClient(account)
        ).items.files.read(input.vaultId, input.itemId, input.file),
      ),
  )

/** Deletes one file field from a 1Password item. */
export const deleteOnePasswordItemFile = defineAction(
  "Delete 1Password item file",
)
  .describe("Deletes a file by its section and field IDs.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      fieldId: z.string().min(1),
      item: ONEPASSWORD_ITEM_SCHEMA,
      sectionId: z.string().min(1),
    }),
  )
  .output(ONEPASSWORD_ITEM_OUTPUT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.files.delete(
      input.item,
      input.sectionId,
      input.fieldId,
    ),
  )

/** Replaces the binary document attached to a Document item. */
export const replaceOnePasswordDocument = defineAction(
  "Replace 1Password document",
)
  .describe("Replaces the document content on a Document-category item.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      document: ONEPASSWORD_DOCUMENT_CREATE_SCHEMA,
      item: ONEPASSWORD_ITEM_SCHEMA,
    }),
  )
  .output(ONEPASSWORD_ITEM_OUTPUT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.files.replaceDocument(
      input.item,
      input.document,
    ),
  )

/** Retrieves the account policy governing item sharing. */
export const getOnePasswordItemSharePolicy = defineAction(
  "Get 1Password item share policy",
)
  .describe("Retrieves the sharing limits enforced for one item.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(ITEM_ID_INPUT_SCHEMA)
  .output(ONEPASSWORD_ITEM_SHARE_POLICY_OUTPUT_SCHEMA)
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.shares.getAccountPolicy(
      input.vaultId,
      input.itemId,
    ),
  )

/** Validates recipient emails or domains against an item-sharing policy. */
export const validateOnePasswordItemShareRecipients = defineAction(
  "Validate 1Password item share recipients",
)
  .describe("Validates recipient strings against the account sharing policy.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      policy: ONEPASSWORD_ITEM_SHARE_POLICY_SCHEMA,
      recipients: z.string().min(1).array().min(1),
    }),
  )
  .output(ONEPASSWORD_VALID_RECIPIENT_SCHEMA.array(), { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.shares.validateRecipients(
      input.policy,
      input.recipients,
    ),
  )

/** Creates a 1Password item-sharing link. */
export const createOnePasswordItemShare = defineAction(
  "Create 1Password item share",
)
  .describe("Creates a policy-compliant sharing link for one item.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      item: ONEPASSWORD_ITEM_SCHEMA,
      parameters: ONEPASSWORD_ITEM_SHARE_PARAMS_SCHEMA,
      policy: ONEPASSWORD_ITEM_SHARE_POLICY_SCHEMA,
    }),
  )
  .output(z.url(), { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).items.shares.create(
      input.item,
      input.policy,
      input.parameters,
    ),
  )

/** Creates a vault owned by the connected 1Password service account. */
export const createOnePasswordVault = defineAction("Create 1Password vault")
  .describe("Creates a vault when the service account can create vaults.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(z.object({ vault: ONEPASSWORD_VAULT_CREATE_SCHEMA }))
  .output(ONEPASSWORD_VAULT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).vaults.create(input.vault),
  )

/** Lists vaults available to the connected 1Password service account. */
export const listOnePasswordVaults = defineAction("List 1Password vaults")
  .describe("Lists accessible vaults with optional decrypted details.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(ONEPASSWORD_VAULT_LIST_PARAMS_SCHEMA)
  .output(ONEPASSWORD_VAULT_OVERVIEW_SCHEMA.array(), { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).vaults.list(input),
  )

/** Retrieves the overview of one 1Password vault. */
export const getOnePasswordVaultOverview = defineAction(
  "Get 1Password vault overview",
)
  .describe("Retrieves one vault's presentation and version metadata.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(z.object({ vaultId: z.string().min(1) }))
  .output(ONEPASSWORD_VAULT_OVERVIEW_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).vaults.getOverview(input.vaultId),
  )

/** Retrieves one detailed 1Password vault. */
export const getOnePasswordVault = defineAction("Get 1Password vault")
  .describe("Retrieves one vault and optionally its accessors.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      parameters: ONEPASSWORD_VAULT_GET_PARAMS_SCHEMA.optional(),
      vaultId: z.string().min(1),
    }),
  )
  .output(ONEPASSWORD_VAULT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).vaults.get(
      input.vaultId,
      input.parameters ?? {},
    ),
  )

/** Updates the title or description of a 1Password vault. */
export const updateOnePasswordVault = defineAction("Update 1Password vault")
  .describe("Updates presentation details on a service-account-owned vault.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      update: ONEPASSWORD_VAULT_UPDATE_SCHEMA,
      vaultId: z.string().min(1),
    }),
  )
  .output(ONEPASSWORD_VAULT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).vaults.update(
      input.vaultId,
      input.update,
    ),
  )

/** Permanently deletes a service-account-owned 1Password vault. */
export const deleteOnePasswordVault = defineAction("Delete 1Password vault")
  .describe("Permanently deletes a vault created by the service account.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(z.object({ vaultId: z.string().min(1) }))
  .output(EMPTY_OUTPUT_SCHEMA)
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) => {
    await (await getOnePasswordClient(account)).vaults.delete(input.vaultId)
    return {}
  })

/** Grants group permissions on a service-account-owned vault. */
export const grantOnePasswordVaultGroupPermissions = defineAction(
  "Grant 1Password vault group permissions",
)
  .describe("Grants permission bitmasks to groups on one owned vault.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      groupPermissions: ONEPASSWORD_GROUP_ACCESS_SCHEMA.array().min(1),
      vaultId: z.string().min(1),
    }),
  )
  .output(EMPTY_OUTPUT_SCHEMA)
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) => {
    await (
      await getOnePasswordClient(account)
    ).vaults.grantGroupPermissions(input.vaultId, input.groupPermissions)
    return {}
  })

/** Replaces group permission bitmasks across 1Password vaults. */
export const updateOnePasswordVaultGroupPermissions = defineAction(
  "Update 1Password vault group permissions",
)
  .describe("Replaces complete group permission sets on owned vaults.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      groupPermissions: ONEPASSWORD_GROUP_VAULT_ACCESS_SCHEMA.array().min(1),
    }),
  )
  .output(EMPTY_OUTPUT_SCHEMA)
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) => {
    await (
      await getOnePasswordClient(account)
    ).vaults.updateGroupPermissions(input.groupPermissions)
    return {}
  })

/** Revokes one group's access to a service-account-owned vault. */
export const revokeOnePasswordVaultGroupPermissions = defineAction(
  "Revoke 1Password vault group permissions",
)
  .describe("Removes one group's access entry from an owned vault.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      groupId: z.string().min(1),
      vaultId: z.string().min(1),
    }),
  )
  .output(EMPTY_OUTPUT_SCHEMA)
  .retry({ replaySafety: "unsafe" })
  .handler(async ({ account, input }) => {
    await (
      await getOnePasswordClient(account)
    ).vaults.revokeGroupPermissions(input.vaultId, input.groupId)
    return {}
  })

/** Reads every variable assigned from one 1Password Environment. */
export const getOnePasswordEnvironmentVariables = defineAction(
  "Get 1Password environment variables",
)
  .describe(
    "Reads variables from an Environment assigned to the service account.",
  )
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(z.object({ environmentId: z.string().min(1) }))
  .output(ONEPASSWORD_ENVIRONMENT_VARIABLES_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).environments.getVariables(
      input.environmentId,
    ),
  )

/** Retrieves one 1Password group and optional vault permissions. */
export const getOnePasswordGroup = defineAction("Get 1Password group")
  .describe("Retrieves one group and optionally its vault access entries.")
  .account("1password", ONEPASSWORD_SERVICE_ACCOUNT_OPTIONS)
  .input(
    z.object({
      groupId: z.string().min(1),
      parameters: ONEPASSWORD_GROUP_GET_PARAMS_SCHEMA.optional(),
    }),
  )
  .output(ONEPASSWORD_GROUP_OUTPUT_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(async ({ account, input }) =>
    (await getOnePasswordClient(account)).groups.get(
      input.groupId,
      input.parameters ?? {},
    ),
  )

/** Retrieves the connected Events Reporting integration and feature scopes. */
export const introspectOnePasswordEventsApi = defineAction(
  "Introspect 1Password Events API",
)
  .describe("Retrieves the connected Events API identity and enabled feeds.")
  .account("1password", onePasswordEventsAccountOptions())
  .output(ONEPASSWORD_EVENTS_INTROSPECTION_SCHEMA)
  .retry({ replaySafety: "safe" })
  .handler(({ account }) => getOnePasswordEventsApi(account).introspect())

/** Lists one cursor page of 1Password account audit events. */
export const listOnePasswordAuditEvents = defineAction(
  "List 1Password audit events",
)
  .describe("Lists account audit activity from a reset or continuation cursor.")
  .account("1password", onePasswordEventsAccountOptions("auditevents"))
  .input(ONEPASSWORD_EVENTS_CURSOR_SCHEMA)
  .output(ONEPASSWORD_AUDIT_EVENT_PAGE_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(({ account, input }) =>
    getOnePasswordEventsApi(account).list(
      "auditevents",
      input,
      ONEPASSWORD_AUDIT_EVENT_PAGE_SCHEMA,
    ),
  )

/** Lists one cursor page of 1Password item-usage events. */
export const listOnePasswordItemUsages = defineAction(
  "List 1Password item usages",
)
  .describe("Lists item access and usage from a reset or continuation cursor.")
  .account("1password", onePasswordEventsAccountOptions("itemusages"))
  .input(ONEPASSWORD_EVENTS_CURSOR_SCHEMA)
  .output(ONEPASSWORD_ITEM_USAGE_PAGE_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(({ account, input }) =>
    getOnePasswordEventsApi(account).list(
      "itemusages",
      input,
      ONEPASSWORD_ITEM_USAGE_PAGE_SCHEMA,
    ),
  )

/** Lists one cursor page of 1Password sign-in attempts. */
export const listOnePasswordSignInAttempts = defineAction(
  "List 1Password sign-in attempts",
)
  .describe("Lists successful and failed sign-ins from an Events API cursor.")
  .account("1password", onePasswordEventsAccountOptions("signinattempts"))
  .input(ONEPASSWORD_EVENTS_CURSOR_SCHEMA)
  .output(ONEPASSWORD_SIGN_IN_ATTEMPT_PAGE_SCHEMA, { sensitive: true })
  .retry({ replaySafety: "safe" })
  .handler(({ account, input }) =>
    getOnePasswordEventsApi(account).list(
      "signinattempts",
      input,
      ONEPASSWORD_SIGN_IN_ATTEMPT_PAGE_SCHEMA,
    ),
  )