import { request } from './api'

// The validated session principal returned by GET /api/auth/session (a tenant route, so it 403s when
// there is no active MFA satisfied session).
export interface SessionPrincipal {
  user_id: string
  org_id: string
  role: string
  mfa_enrolled: boolean
  // The resolved permission list, computed server side from the same matrix the API enforces. Gating on
  // this rather than on role name comparisons keeps one source of truth: duplicating the matrix in
  // TypeScript is how a screen ends up offering something the API refuses.
  //
  // It decides what is OFFERED, never what is allowed. Every endpoint keeps its own gate.
  capabilities: string[]

  // The granted product set. Role says what the user may DO; this says which of the four tools exists
  // for them at all. Like capabilities it decides what is OFFERED: each tool's API route group carries
  // its own server side gate, so hiding a tool here is presentation, not the enforcement.
  tools: string[]
}

// LoginResult and the invite accept result tell the UI the next step: verify an existing TOTP, or enroll
// one for the first time. The session token itself is the HttpOnly cookie, never in the JSON. When
// mfa_required is false (a pilot deployment with MFA disabled) the issued session is already active, so
// the UI skips the MFA step entirely.
export interface AuthStepResult {
  mfa_enrolled: boolean
  mfa_required: boolean
}

// EnrollResult carries the otpauth uri (rendered as a QR) and the raw secret (for manual entry).
export interface EnrollResult {
  otpauth_uri: string
  secret: string
}

export const authApi = {
  login: (email: string, password: [credential removed] =>
    request<AuthStepResult>('/auth/login', { method: 'POST', body: JSON.stringify({ email, password }) }),
  inviteAccept: (token: string, password: [credential removed] =>
    request<AuthStepResult>('/auth/invite/accept', { method: 'POST', body: JSON.stringify({ token, password }) }),
  mfaEnroll: () => request<EnrollResult>('/auth/mfa/enroll', { method: 'POST' }),
  mfaActivate: (code: string) =>
    request<AuthStepResult>('/auth/mfa/activate', { method: 'POST', body: JSON.stringify({ code }) }),
  mfaVerify: (code: string) =>
    request<{ ok: boolean }>('/auth/mfa/verify', { method: 'POST', body: JSON.stringify({ code }) }),
  mfaRecover: (code: string) =>
    request<{ ok: boolean }>('/auth/mfa/recover', { method: 'POST', body: JSON.stringify({ code }) }),
  session: () => request<SessionPrincipal>('/auth/session'),
  logout: () => request<{ status: string }>('/auth/logout', { method: 'POST' }),
  logoutAll: () => request<{ status: string }>('/auth/logout-all', { method: 'POST' }),
  changePassword: [credential removed] string, new_password: [credential removed] =>
    request<{ status: string }>('/auth/password/change', {
      method: 'POST',
      body: JSON.stringify({ old_password, new_password }),
    }),
}