import { request } from './api'

export interface UserSummary {
  id: string
  email: string
  full_name: string
  role: string
  status: string
  mfa_enrolled: boolean
}

// InviteResult carries the one time invite token. Delivery is manual at pilot, so the UI shows the
// accept link for the inviter to send out of band (there is no email transport yet).
export interface InviteResult {
  token: string
  user_id: string
}

export const ROLES = ['admin', 'recruiter', 'member', 'viewer'] as const

export const adminApi = {
  listUsers: () => request<UserSummary[]>('/users'),
  invite: (email: string, full_name: string, role: string) =>
    request<InviteResult>('/users/invite', { method: 'POST', body: JSON.stringify({ email, full_name, role }) }),
  changeRole: (id: string, role: string) =>
    request<{ status: string }>(`/users/${id}/role`, { method: 'PATCH', body: JSON.stringify({ role }) }),
  changeStatus: (id: string, status: 'active' | 'disabled') =>
    request<{ status: string }>(`/users/${id}/status`, { method: 'PATCH', body: JSON.stringify({ status }) }),
  resetMFA: (id: string) => request<{ status: string }>(`/users/${id}/mfa/reset`, { method: 'POST' }),
  reissueRecovery: (id: string) => request<{ token?: string }>(`/users/${id}/recovery`, { method: 'POST' }),
}