/**
 * Auth Module Types
 * Type definitions for authentication, authorization, and user management
 * Aligned with auth schema DDL (01-enums.sql)
 */

// ============================================================================
// User Types (Alineado con auth.* DDL)
// ============================================================================

// Alineado con auth.user_status (DDL)
export type UserStatus =
  | 'pending_verification'
  | 'active'
  | 'suspended'
  | 'deactivated'
  | 'banned';

// Alineado con auth.user_role (DDL)
export type UserRole =
  | 'user'
  | 'trader'
  | 'analyst'
  | 'admin'
  | 'super_admin';

// Alineado con auth.oauth_provider (DDL)
export type OAuthProvider =
  | 'google'
  | 'facebook'
  | 'apple'
  | 'github'
  | 'microsoft'
  | 'twitter';

// Alineado con auth.phone_channel (DDL)
export type PhoneChannel = 'sms' | 'whatsapp';

// Alineado con auth.mfa_method (DDL)
export type MfaMethod = 'none' | 'totp' | 'sms' | 'email';

// Alineado con auth.auth_event_type (DDL)
export type AuthEventType =
  | 'login'
  | 'logout'
  | 'register'
  | 'password_change'
  | 'password_reset_request'
  | 'password_reset_complete'
  | 'email_verification'
  | 'phone_verification'
  | 'mfa_enabled'
  | 'mfa_disabled'
  | 'session_expired'
  | 'account_suspended'
  | 'account_reactivated'
  | 'failed_login'
  | 'oauth_linked'
  | 'oauth_unlinked';

// ============================================================================
// User Interface
// ============================================================================

export interface User {
  id: string;
  tenantId: string;
  email: string;
  username?: string;
  displayName?: string;
  avatarUrl?: string;
  status: UserStatus;
  role: UserRole;
  emailVerified: boolean;
  phoneVerified: boolean;
  phone?: string;
  mfaEnabled: boolean;
  mfaMethod: MfaMethod;
  lastLoginAt?: string;
  createdAt: string;
  updatedAt: string;
}

// ============================================================================
// Session Types
// ============================================================================

export interface Session {
  id: string;
  userId: string;
  tenantId: string;
  accessToken: string;
  refreshToken: string;
  expiresAt: string;
  ipAddress?: string;
  userAgent?: string;
  deviceId?: string;
  isActive: boolean;
  createdAt: string;
  lastActivityAt: string;
}

export interface AuthTokens {
  accessToken: string;
  refreshToken: string;
  expiresIn: number;
  tokenType: 'Bearer';
}

// ============================================================================
// OAuth Types
// ============================================================================

export interface OAuthAccount {
  id: string;
  userId: string;
  provider: OAuthProvider;
  providerAccountId: string;
  email?: string;
  displayName?: string;
  avatarUrl?: string;
  accessToken?: string;
  refreshToken?: string;
  expiresAt?: string;
  linkedAt: string;
}

// ============================================================================
// RBAC Types
// ============================================================================

export interface Permission {
  id: string;
  name: string;
  resource: string;
  action: 'create' | 'read' | 'update' | 'delete' | 'manage';
  description?: string;
}

export interface RolePermission {
  roleId: string;
  role: UserRole;
  permissionId: string;
  permission: Permission;
  grantedAt: string;
  grantedBy?: string;
}

export interface Role {
  id: string;
  name: UserRole;
  displayName: string;
  description?: string;
  permissions: Permission[];
  isSystem: boolean;
  createdAt: string;
}

// ============================================================================
// Team Types
// ============================================================================

export type TeamMemberStatus = 'pending' | 'active' | 'suspended' | 'removed';
export type TeamMemberRole = 'owner' | 'admin' | 'member' | 'viewer';

export interface Team {
  id: string;
  tenantId: string;
  name: string;
  slug: string;
  description?: string;
  avatarUrl?: string;
  ownerId: string;
  memberCount: number;
  createdAt: string;
  updatedAt: string;
}

export interface TeamMember {
  id: string;
  teamId: string;
  userId: string;
  user?: User;
  role: TeamMemberRole;
  status: TeamMemberStatus;
  invitedBy?: string;
  invitedAt?: string;
  joinedAt?: string;
  createdAt: string;
  updatedAt: string;
}

export interface TeamInvite {
  id: string;
  teamId: string;
  email: string;
  role: TeamMemberRole;
  token: string;
  expiresAt: string;
  invitedBy: string;
  acceptedAt?: string;
  createdAt: string;
}

// ============================================================================
// Auth Event Types
// ============================================================================

export interface AuthEvent {
  id: string;
  userId: string;
  eventType: AuthEventType;
  ipAddress?: string;
  userAgent?: string;
  metadata?: Record<string, unknown>;
  createdAt: string;
}

// ============================================================================
// API Request/Response Types
// ============================================================================

export interface LoginRequest {
  email: string;
  password: string;
  rememberMe?: boolean;
}

export interface RegisterRequest {
  email: string;
  password: string;
  displayName?: string;
  acceptTerms: boolean;
}

export interface AuthResponse {
  user: User;
  tokens: AuthTokens;
  session: Session;
}

export interface OAuthLoginRequest {
  provider: OAuthProvider;
  code: string;
  state?: string;
  redirectUri: string;
}

export interface VerifyEmailRequest {
  token: string;
}

export interface ResetPasswordRequest {
  email: string;
}

export interface SetNewPasswordRequest {
  token: string;
  password: string;
}

export interface EnableMfaRequest {
  method: MfaMethod;
  secret?: string;
  verificationCode?: string;
}
