import {
  AllowedRecipientType,
  AllowedType,
  AutofillBehavior,
  GroupState,
  GroupType,
  ItemCategory,
  ItemFieldType,
  ItemShareDuration,
  ItemState,
  SeparatorType,
  VaultAccessorType,
  VaultType,
  WordListType,
} from "@1password/sdk"
import * as z from "zod"

/** 1Password item categories supported by the JavaScript SDK. */
export const ONEPASSWORD_ITEM_CATEGORY_SCHEMA = z.enum(ItemCategory)

/** 1Password item field types supported by the JavaScript SDK. */
export const ONEPASSWORD_ITEM_FIELD_TYPE_SCHEMA = z.enum(ItemFieldType)

/** Auto-fill behavior for a website attached to a 1Password item. */
export const ONEPASSWORD_AUTOFILL_BEHAVIOR_SCHEMA = z.enum(AutofillBehavior)

export const ONEPASSWORD_ADDRESS_FIELD_DETAILS_SCHEMA = z.object({
  city: z.string(),
  country: z.string(),
  state: z.string(),
  street: z.string(),
  zip: z.string(),
})

export const ONEPASSWORD_FILE_ATTRIBUTES_SCHEMA = z.object({
  id: z.string().min(1),
  name: z.string().min(1),
  size: z.number().int().nonnegative(),
})

export const ONEPASSWORD_DOCUMENT_CREATE_SCHEMA = z.object({
  content: z.instanceof(Uint8Array),
  name: z.string().min(1),
})

export const ONEPASSWORD_FILE_CREATE_SCHEMA = z.object({
  content: z.instanceof(Uint8Array),
  fieldId: z.string().min(1),
  name: z.string().min(1),
  sectionId: z.string().min(1),
})

export const ONEPASSWORD_ITEM_SECTION_SCHEMA = z.object({
  id: z.string(),
  title: z.string(),
})

const ONEPASSWORD_ITEM_FIELD_DETAILS_SCHEMA = z.discriminatedUnion("type", [
  z.object({
    content: z.object({
      code: z.string().optional(),
      errorMessage: z.string().optional(),
    }),
    type: z.literal("Otp"),
  }),
  z.object({
    content: z
      .object({
        fingerprint: z.string(),
        keyType: z.string(),
        publicKey: z.string(),
      })
      .optional(),
    type: z.literal("SshKey"),
  }),
  z.object({
    content: ONEPASSWORD_ADDRESS_FIELD_DETAILS_SCHEMA.optional(),
    type: z.literal("Address"),
  }),
])

export const ONEPASSWORD_ITEM_FIELD_SCHEMA = z.object({
  details: ONEPASSWORD_ITEM_FIELD_DETAILS_SCHEMA.optional(),
  fieldType: ONEPASSWORD_ITEM_FIELD_TYPE_SCHEMA,
  id: z.string(),
  sectionId: z.string().optional(),
  title: z.string(),
  value: z.string(),
})

const ONEPASSWORD_ITEM_FIELD_OUTPUT_SCHEMA =
  ONEPASSWORD_ITEM_FIELD_SCHEMA.extend({
    details: ONEPASSWORD_ITEM_FIELD_DETAILS_SCHEMA.nullable()
      .transform((details) => details ?? undefined)
      .optional(),
  })

export const ONEPASSWORD_WEBSITE_SCHEMA = z.object({
  autofillBehavior: ONEPASSWORD_AUTOFILL_BEHAVIOR_SCHEMA,
  label: z.string(),
  url: z.string(),
})

export const ONEPASSWORD_ITEM_FILE_SCHEMA = z.object({
  attributes: ONEPASSWORD_FILE_ATTRIBUTES_SCHEMA,
  fieldId: z.string(),
  sectionId: z.string(),
})

/** Full decrypted 1Password item. */
export const ONEPASSWORD_ITEM_SCHEMA = z.object({
  category: ONEPASSWORD_ITEM_CATEGORY_SCHEMA,
  createdAt: z.date(),
  document: ONEPASSWORD_FILE_ATTRIBUTES_SCHEMA.optional(),
  fields: ONEPASSWORD_ITEM_FIELD_SCHEMA.array(),
  files: ONEPASSWORD_ITEM_FILE_SCHEMA.array(),
  id: z.string().min(1),
  notes: z.string(),
  sections: ONEPASSWORD_ITEM_SECTION_SCHEMA.array(),
  tags: z.string().array(),
  title: z.string(),
  updatedAt: z.date(),
  vaultId: z.string().min(1),
  version: z.number().int().nonnegative(),
  websites: ONEPASSWORD_WEBSITE_SCHEMA.array(),
})

/** Full decrypted 1Password item normalized from the SDK runtime response. */
export const ONEPASSWORD_ITEM_OUTPUT_SCHEMA = ONEPASSWORD_ITEM_SCHEMA.extend({
  document: ONEPASSWORD_FILE_ATTRIBUTES_SCHEMA.nullable()
    .transform((document) => document ?? undefined)
    .optional(),
  fields: ONEPASSWORD_ITEM_FIELD_OUTPUT_SCHEMA.array(),
})

/** Parameters accepted when creating a 1Password item. */
export const ONEPASSWORD_ITEM_CREATE_SCHEMA = z.object({
  category: ONEPASSWORD_ITEM_CATEGORY_SCHEMA,
  document: ONEPASSWORD_DOCUMENT_CREATE_SCHEMA.optional(),
  fields: ONEPASSWORD_ITEM_FIELD_SCHEMA.array().optional(),
  files: ONEPASSWORD_FILE_CREATE_SCHEMA.array().optional(),
  notes: z.string().optional(),
  sections: ONEPASSWORD_ITEM_SECTION_SCHEMA.array().optional(),
  tags: z.string().array().optional(),
  title: z.string().min(1),
  vaultId: z.string().min(1),
  websites: ONEPASSWORD_WEBSITE_SCHEMA.array().optional(),
})

export const ONEPASSWORD_ITEM_OVERVIEW_SCHEMA = z.object({
  category: ONEPASSWORD_ITEM_CATEGORY_SCHEMA,
  createdAt: z.date(),
  id: z.string().min(1),
  state: z.enum(ItemState),
  tags: z.string().array(),
  title: z.string(),
  updatedAt: z.date(),
  vaultId: z.string().min(1),
  websites: ONEPASSWORD_WEBSITE_SCHEMA.array(),
})

export const ONEPASSWORD_ITEM_LIST_FILTER_SCHEMA = z.object({
  content: z.object({ active: z.boolean(), archived: z.boolean() }),
  type: z.literal("ByState"),
})

const ONEPASSWORD_ITEM_UPDATE_FAILURE_SCHEMA = z.discriminatedUnion("type", [
  z.object({ message: z.string(), type: z.literal("itemValidationError") }),
  z.object({ type: z.literal("itemStatusPermissionError") }),
  z.object({ type: z.literal("itemStatusIncorrectItemVersion") }),
  z.object({ type: z.literal("itemStatusFileNotFound") }),
  z.object({ type: z.literal("itemStatusTooBig") }),
  z.object({ type: z.literal("itemNotFound") }),
  z.object({ message: z.string(), type: z.literal("internal") }),
])

const ONEPASSWORD_ITEM_GET_FAILURE_SCHEMA = z.discriminatedUnion("type", [
  z.object({ type: z.literal("itemNotFound") }),
  z.object({ message: z.string(), type: z.literal("internal") }),
])

const onePasswordResponseSchema = <T extends z.ZodType, E extends z.ZodType>(
  content: T,
  error: E,
) =>
  z.object({
    content: content
      .nullable()
      .transform((value) => value ?? undefined)
      .optional(),
    error: error
      .nullable()
      .transform((value) => value ?? undefined)
      .optional(),
  })

export const ONEPASSWORD_ITEMS_UPDATE_ALL_RESPONSE_SCHEMA = z.object({
  individualResponses: onePasswordResponseSchema(
    ONEPASSWORD_ITEM_OUTPUT_SCHEMA,
    ONEPASSWORD_ITEM_UPDATE_FAILURE_SCHEMA,
  ).array(),
})

export const ONEPASSWORD_ITEMS_GET_ALL_RESPONSE_SCHEMA = z.object({
  individualResponses: onePasswordResponseSchema(
    ONEPASSWORD_ITEM_OUTPUT_SCHEMA,
    ONEPASSWORD_ITEM_GET_FAILURE_SCHEMA,
  ).array(),
})

export const ONEPASSWORD_ITEMS_DELETE_ALL_RESPONSE_SCHEMA = z.object({
  individualResponses: z.record(
    z.string(),
    onePasswordResponseSchema(
      z.undefined(),
      ONEPASSWORD_ITEM_UPDATE_FAILURE_SCHEMA,
    ),
  ),
})

/** Password-generation recipe accepted by the 1Password SDK. */
export const ONEPASSWORD_PASSWORD_RECIPE_SCHEMA = z.discriminatedUnion("type", [
  z.object({
    parameters: z.object({
      capitalize: z.boolean(),
      separatorType: z.enum(SeparatorType),
      wordCount: z.number().int().positive(),
      wordListType: z.enum(WordListType),
    }),
    type: z.literal("Memorable"),
  }),
  z.object({
    parameters: z.object({ length: z.number().int().positive() }),
    type: z.literal("Pin"),
  }),
  z.object({
    parameters: z.object({
      includeDigits: z.boolean(),
      includeSymbols: z.boolean(),
      length: z.number().int().positive(),
    }),
    type: z.literal("Random"),
  }),
])

const ONEPASSWORD_RESOLVE_ERROR_SCHEMA = z.discriminatedUnion("type", [
  z.object({ message: z.string(), type: z.literal("parsing") }),
  z.object({ type: z.literal("fieldNotFound") }),
  z.object({ type: z.literal("vaultNotFound") }),
  z.object({ type: z.literal("tooManyVaults") }),
  z.object({ type: z.literal("itemNotFound") }),
  z.object({ type: z.literal("tooManyItems") }),
  z.object({ type: z.literal("tooManyMatchingFields") }),
  z.object({ type: z.literal("noMatchingSections") }),
  z.object({ type: z.literal("incompatibleTOTPQueryParameterField") }),
  z.object({
    message: z.string(),
    type: z.literal("unableToGenerateTotpCode"),
  }),
  z.object({ type: z.literal("sSHKeyMetadataNotFound") }),
  z.object({ type: z.literal("unsupportedFileFormat") }),
  z.object({ type: z.literal("incompatibleSshKeyQueryParameterField") }),
  z.object({ type: z.literal("unableToParsePrivateKey") }),
  z.object({ type: z.literal("unableToFormatPrivateKeyToOpenSsh") }),
  z.object({ type: z.literal("other") }),
])

export const ONEPASSWORD_RESOLVE_ALL_RESPONSE_SCHEMA = z.object({
  individualResponses: z.record(
    z.string(),
    onePasswordResponseSchema(
      z.object({
        itemId: z.string().min(1),
        secret: z.string(),
        vaultId: z.string().min(1),
      }),
      ONEPASSWORD_RESOLVE_ERROR_SCHEMA,
    ),
  ),
})

/** Supported 1Password item-share expiry durations. */
export const ONEPASSWORD_ITEM_SHARE_DURATION_SCHEMA = z.enum(ItemShareDuration)

export const ONEPASSWORD_VALID_RECIPIENT_SCHEMA = z.discriminatedUnion("type", [
  z.object({
    parameters: z.object({ email: z.email() }),
    type: z.literal("Email"),
  }),
  z.object({
    parameters: z.object({ domain: z.string().min(1) }),
    type: z.literal("Domain"),
  }),
])

export const ONEPASSWORD_ITEM_SHARE_FILES_SCHEMA = z.object({
  allowed: z.boolean(),
  allowedRecipientTypes: z.enum(AllowedRecipientType).array().optional(),
  allowedTypes: z.enum(AllowedType).array().optional(),
  defaultExpiry: ONEPASSWORD_ITEM_SHARE_DURATION_SCHEMA.optional(),
  maxExpiry: ONEPASSWORD_ITEM_SHARE_DURATION_SCHEMA.optional(),
  maxSize: z.number().int().nonnegative(),
  maxViews: z.number().int().optional(),
})

export const ONEPASSWORD_ITEM_SHARE_POLICY_SCHEMA = z.object({
  allowedRecipientTypes: z.enum(AllowedRecipientType).array(),
  allowedTypes: z.enum(AllowedType).array(),
  defaultExpiry: ONEPASSWORD_ITEM_SHARE_DURATION_SCHEMA,
  files: ONEPASSWORD_ITEM_SHARE_FILES_SCHEMA,
  maxExpiry: ONEPASSWORD_ITEM_SHARE_DURATION_SCHEMA,
  maxViews: z.number().int().optional(),
})

const ONEPASSWORD_ITEM_SHARE_FILES_OUTPUT_SCHEMA =
  ONEPASSWORD_ITEM_SHARE_FILES_SCHEMA.extend({
    allowedRecipientTypes: z
      .enum(AllowedRecipientType)
      .array()
      .nullable()
      .transform((value) => value ?? undefined)
      .optional(),
    allowedTypes: z
      .enum(AllowedType)
      .array()
      .nullable()
      .transform((value) => value ?? undefined)
      .optional(),
    defaultExpiry: ONEPASSWORD_ITEM_SHARE_DURATION_SCHEMA.nullable()
      .transform((value) => value ?? undefined)
      .optional(),
    maxExpiry: ONEPASSWORD_ITEM_SHARE_DURATION_SCHEMA.nullable()
      .transform((value) => value ?? undefined)
      .optional(),
    maxViews: z
      .number()
      .int()
      .nullable()
      .transform((value) => value ?? undefined)
      .optional(),
  })

/** Item-sharing policy normalized from the SDK runtime response. */
export const ONEPASSWORD_ITEM_SHARE_POLICY_OUTPUT_SCHEMA =
  ONEPASSWORD_ITEM_SHARE_POLICY_SCHEMA.extend({
    files: ONEPASSWORD_ITEM_SHARE_FILES_OUTPUT_SCHEMA,
    maxViews: z
      .number()
      .int()
      .nullable()
      .transform((value) => value ?? undefined)
      .optional(),
  })

export const ONEPASSWORD_ITEM_SHARE_PARAMS_SCHEMA = z.object({
  expireAfter: ONEPASSWORD_ITEM_SHARE_DURATION_SCHEMA.optional(),
  oneTimeOnly: z.boolean(),
  recipients: ONEPASSWORD_VALID_RECIPIENT_SCHEMA.array().optional(),
})

/** 1Password vault types returned by the JavaScript SDK. */
export const ONEPASSWORD_VAULT_TYPE_SCHEMA = z.enum(VaultType)

export const ONEPASSWORD_VAULT_ACCESS_SCHEMA = z.object({
  accessorType: z.enum(VaultAccessorType),
  accessorUuid: z.string().min(1),
  permissions: z.number().int().nonnegative(),
  vaultUuid: z.string().min(1),
})

/** Detailed 1Password vault. */
export const ONEPASSWORD_VAULT_SCHEMA = z.object({
  access: ONEPASSWORD_VAULT_ACCESS_SCHEMA.array().optional(),
  activeItemCount: z.number().int().nonnegative(),
  attributeVersion: z.number().int().nonnegative(),
  contentVersion: z.number().int().nonnegative(),
  description: z.string(),
  id: z.string().min(1),
  title: z.string(),
  vaultType: ONEPASSWORD_VAULT_TYPE_SCHEMA,
})

export const ONEPASSWORD_VAULT_OVERVIEW_SCHEMA = z.object({
  activeItemCount: z.number().int().nonnegative(),
  attributeVersion: z.number().int().nonnegative(),
  contentVersion: z.number().int().nonnegative(),
  createdAt: z.date(),
  description: z.string(),
  id: z.string().min(1),
  title: z.string(),
  updatedAt: z.date(),
  vaultType: ONEPASSWORD_VAULT_TYPE_SCHEMA,
})

export const ONEPASSWORD_VAULT_CREATE_SCHEMA = z.object({
  allowAdminsAccess: z.boolean().optional(),
  description: z.string().optional(),
  title: z.string().min(1),
})

export const ONEPASSWORD_VAULT_UPDATE_SCHEMA = z
  .object({
    description: z.string().optional(),
    title: z.string().min(1).optional(),
  })
  .refine((value) => value.description !== undefined || value.title, {
    message: "Provide a title or description to update.",
  })

export const ONEPASSWORD_VAULT_GET_PARAMS_SCHEMA = z.object({
  accessors: z.boolean().optional(),
})

export const ONEPASSWORD_VAULT_LIST_PARAMS_SCHEMA = z.object({
  decryptDetails: z.boolean().optional(),
})

export const ONEPASSWORD_GROUP_ACCESS_SCHEMA = z.object({
  groupId: z.string().min(1),
  permissions: z.number().int().nonnegative(),
})

export const ONEPASSWORD_GROUP_VAULT_ACCESS_SCHEMA = z.object({
  groupId: z.string().min(1),
  permissions: z.number().int().nonnegative(),
  vaultId: z.string().min(1),
})

export const ONEPASSWORD_GROUP_GET_PARAMS_SCHEMA = z.object({
  vaultPermissions: z.boolean().optional(),
})

export const ONEPASSWORD_GROUP_SCHEMA = z.object({
  description: z.string(),
  groupType: z.enum(GroupType),
  id: z.string().min(1),
  state: z.enum(GroupState),
  title: z.string(),
  vaultAccess: ONEPASSWORD_VAULT_ACCESS_SCHEMA.array().optional(),
})

/** Group normalized from the SDK runtime response. */
export const ONEPASSWORD_GROUP_OUTPUT_SCHEMA = ONEPASSWORD_GROUP_SCHEMA.extend({
  vaultAccess: ONEPASSWORD_VAULT_ACCESS_SCHEMA.array()
    .nullable()
    .transform((value) => value ?? undefined)
    .optional(),
})

export const ONEPASSWORD_ENVIRONMENT_VARIABLE_SCHEMA = z.object({
  masked: z.boolean(),
  name: z.string().min(1),
  value: z.string(),
})

export const ONEPASSWORD_ENVIRONMENT_VARIABLES_SCHEMA = z.object({
  variables: ONEPASSWORD_ENVIRONMENT_VARIABLE_SCHEMA.array(),
})

/** Official origins accepted for the 1Password Events API. */
export const ONEPASSWORD_EVENTS_API_ORIGINS = [
  "https://events.1password.com",
  "https://events.1password.ca",
  "https://events.1password.eu",
  "https://events.ent.1password.com",
] as const

export const ONEPASSWORD_EVENTS_FEATURE_SCHEMA = z.enum([
  "auditevents",
  "itemusages",
  "signinattempts",
])

export const ONEPASSWORD_EVENTS_INTROSPECTION_SCHEMA = z.object({
  accountUuid: z.string().min(1),
  features: ONEPASSWORD_EVENTS_FEATURE_SCHEMA.array(),
  issuedAt: z.date(),
  uuid: z.string().min(1),
})

const EVENT_DATE_INPUT_SCHEMA = z.union([
  z.date(),
  z.iso.datetime({ offset: true }),
])

/** Reset or continuation cursor accepted by every Events API feed. */
export const ONEPASSWORD_EVENTS_CURSOR_SCHEMA = z.union([
  z.object({ cursor: z.string().min(1) }).strict(),
  z
    .object({
      endTime: EVENT_DATE_INPUT_SCHEMA.optional(),
      limit: z.number().int().min(1).max(1000).optional(),
      startTime: EVENT_DATE_INPUT_SCHEMA.optional(),
    })
    .strict()
    .refine(
      ({ endTime, startTime }) =>
        !endTime ||
        !startTime ||
        new Date(startTime).getTime() <= new Date(endTime).getTime(),
      { message: "startTime must be before or equal to endTime." },
    ),
])

const ONEPASSWORD_EVENT_USER_SCHEMA = z.object({
  email: z.email().optional(),
  name: z.string().optional(),
  userAccountUuid: z.string().optional(),
  userType: z.enum(["user", "external_user"]).optional(),
  uuid: z.string().optional(),
})

const ONEPASSWORD_EVENT_CLIENT_SCHEMA = z.object({
  appName: z.string().optional(),
  appVersion: z.string().optional(),
  ipAddress: z.string().optional(),
  osName: z.string().optional(),
  osVersion: z.string().optional(),
  platformName: z.string().optional(),
  platformVersion: z.string().optional(),
})

const ONEPASSWORD_EVENT_LOCATION_SCHEMA = z.object({
  city: z.string().optional(),
  country: z.string().optional(),
  latitude: z.number().optional(),
  longitude: z.number().optional(),
  region: z.string().optional(),
})

export const ONEPASSWORD_SIGN_IN_CATEGORY_SCHEMA = z.enum([
  "success",
  "credentials_failed",
  "mfa_failed",
  "sso_failed",
  "modern_version_failed",
  "firewall_failed",
  "firewall_reported_success",
])

export const ONEPASSWORD_SIGN_IN_TYPE_SCHEMA = z.enum([
  "credentials_ok",
  "mfa_ok",
  "federated",
  "password_secret_bad",
  "mfa_missing",
  "totp_disabled",
  "totp_bad",
  "totp_timeout",
  "u2f_disabled",
  "u2f_bad",
  // The 1.4.1 OpenAPI file contains the first spelling; its rendered reference uses the second.
  "u2f_timout",
  "u2f_timeout",
  "duo_disabled",
  "duo_bad",
  "duo_timeout",
  "duo_native_bad",
  "service_account_sso_denied",
  "non_sso_user",
  "sso_user_mismatch",
  "platform_secret_disabled",
  "platform_secret_bad",
  "platform_secret_proxy",
  "code_disabled",
  "code_bad",
  "code_timeout",
  "ip_blocked",
  "continent_blocked",
  "country_blocked",
  "anonymous_blocked",
  "all_blocked",
  "modern_version_missing",
  "modern_version_old",
])

export const ONEPASSWORD_SIGN_IN_ATTEMPT_SCHEMA = z.object({
  accountUuid: z.string().optional(),
  category: ONEPASSWORD_SIGN_IN_CATEGORY_SCHEMA.optional(),
  client: ONEPASSWORD_EVENT_CLIENT_SCHEMA.optional(),
  country: z.string().optional(),
  details: z.object({ value: z.string().optional() }).optional(),
  location: ONEPASSWORD_EVENT_LOCATION_SCHEMA.optional(),
  sessionUuid: z.string().optional(),
  targetUser: ONEPASSWORD_EVENT_USER_SCHEMA.optional(),
  timestamp: z.date().optional(),
  type: ONEPASSWORD_SIGN_IN_TYPE_SCHEMA.optional(),
  uuid: z.string().optional(),
})

export const ONEPASSWORD_ITEM_USAGE_ACTION_SCHEMA = z.enum([
  "fill",
  "select-sso-provider",
  "enter-item-edit-mode",
  "export",
  "share",
  "secure-copy",
  "reveal",
  "server-create",
  "server-update",
  "server-fetch",
  "other",
])

export const ONEPASSWORD_ITEM_USAGE_SCHEMA = z.object({
  accountUuid: z.string().optional(),
  action: ONEPASSWORD_ITEM_USAGE_ACTION_SCHEMA.optional(),
  client: ONEPASSWORD_EVENT_CLIENT_SCHEMA.optional(),
  itemUuid: z.string().optional(),
  location: ONEPASSWORD_EVENT_LOCATION_SCHEMA.optional(),
  timestamp: z.date().optional(),
  usedVersion: z.number().int().optional(),
  user: ONEPASSWORD_EVENT_USER_SCHEMA.optional(),
  uuid: z.string().optional(),
  vaultUuid: z.string().optional(),
})

export const ONEPASSWORD_AUDIT_ACTION_SCHEMA = z.enum([
  "activate",
  "update",
  "delete",
  "convert",
  "enblduo",
  "updatduo",
  "disblduo",
  "rdmchild",
  "detchild",
  "dlgsess",
  "create",
  "deolddev",
  "dealldev",
  "reauth",
  "begin",
  "complete",
  "propose",
  "updatfw",
  "join",
  "leave",
  "role",
  "purge",
  "view",
  "export",
  "replace",
  "grant",
  "revoke",
  "share",
  "delshare",
  "uisas",
  "enblmfa",
  "updatmfa",
  "disblmfa",
  "musercom",
  "muserdec",
  "sendpkg",
  "resendts",
  "prsndall",
  "trename",
  "tverify",
  "trevoke",
  "ssotknv",
  "enblsso",
  "disblsso",
  "chngpsso",
  "chngasso",
  "chngdsso",
  "delgsso",
  "addgsso",
  "cancel",
  "hide",
  "unhide",
  "upguest",
  "verify",
  "reactive",
  "suspend",
  "beginr",
  "provsn",
  "sendts",
  "unknown",
  "completr",
  "cancelr",
  "trvlaway",
  "trvlback",
  "changeks",
  "changemp",
  "changesk",
  "changenm",
  "changela",
  "tdvcsso",
  "sdvcsso",
  "patch",
  "updatea",
  "vrfydmn",
  "uvrfydmn",
  "dvrfydmn",
  "expire",
  "launchi",
  "unlink",
])

export const ONEPASSWORD_AUDIT_OBJECT_TYPE_SCHEMA = z.enum([
  "account",
  "user",
  "device",
  "group",
  "gm",
  "vault",
  "item",
  "items",
  "itemhist",
  "vaultkey",
  "template",
  "uva",
  "gva",
  "invite",
  "ec",
  "miguser",
  "sso",
  "sub",
  "card",
  "pm",
  "slackapp",
  "file",
  "famchild",
  "sa",
  "satoken",
  "dlgdsess",
  "ssotkn",
  "report",
  "cred",
  "mngdacc",
])

export const ONEPASSWORD_AUDIT_EVENT_SCHEMA = z.object({
  accountUuid: z.string().optional(),
  action: ONEPASSWORD_AUDIT_ACTION_SCHEMA.optional(),
  actorAccountUuid: z.string().optional(),
  actorDetails: ONEPASSWORD_EVENT_USER_SCHEMA.optional(),
  actorType: z.enum(["user", "external_user"]).optional(),
  actorUuid: z.string().optional(),
  auxDetails: ONEPASSWORD_EVENT_USER_SCHEMA.optional(),
  auxId: z.number().int().optional(),
  auxInfo: z.string().optional(),
  auxUuid: z.string().optional(),
  location: ONEPASSWORD_EVENT_LOCATION_SCHEMA.optional(),
  objectDetails: ONEPASSWORD_EVENT_USER_SCHEMA.optional(),
  objectType: ONEPASSWORD_AUDIT_OBJECT_TYPE_SCHEMA.optional(),
  objectUuid: z.string().optional(),
  session: z
    .object({
      deviceUuid: z.string().optional(),
      ip: z.string().optional(),
      loginTime: z.date().optional(),
      uuid: z.string().optional(),
    })
    .optional(),
  timestamp: z.date().optional(),
  uuid: z.string().optional(),
})

/**
 * Creates the common cursor page returned by an Events API feed.
 *
 * @param item - Runtime schema for one feed item.
 */
export function onePasswordEventPageSchema<T extends z.ZodType>(item: T) {
  return z.object({
    cursor: z.string(),
    hasMore: z.boolean(),
    items: item.array(),
  })
}

export const ONEPASSWORD_AUDIT_EVENT_PAGE_SCHEMA = onePasswordEventPageSchema(
  ONEPASSWORD_AUDIT_EVENT_SCHEMA,
)
export const ONEPASSWORD_ITEM_USAGE_PAGE_SCHEMA = onePasswordEventPageSchema(
  ONEPASSWORD_ITEM_USAGE_SCHEMA,
)
export const ONEPASSWORD_SIGN_IN_ATTEMPT_PAGE_SCHEMA =
  onePasswordEventPageSchema(ONEPASSWORD_SIGN_IN_ATTEMPT_SCHEMA)

export type OnePasswordEventsCursor = z.infer<
  typeof ONEPASSWORD_EVENTS_CURSOR_SCHEMA
>
export type OnePasswordEventsIntrospection = z.infer<
  typeof ONEPASSWORD_EVENTS_INTROSPECTION_SCHEMA
>