/**
 * Federation OIDC Types
 *
 * Types for federated authentication using OIDC/OAuth2.
 */

/**
 * Configuration for a federated OIDC provider
 */
export interface FederatedOIDCConfig {
  /** OIDC issuer URL (e.g., https://auth.example.com/application/o/mosaic/) */
  issuer: string;
  /** OAuth2 client ID */
  clientId: string;
  /** OAuth2 client secret */
  clientSecret: string;
  /** Redirect URI for OAuth2 callback */
  redirectUri: string;
  /** OIDC scopes to request */
  scopes: string[];
  /** Optional: OIDC discovery URL override */
  discoveryUrl?: string;
}

/**
 * Result of OIDC token validation
 */
export interface FederatedTokenValidation {
  /** Whether the token is valid */
  valid: boolean;
  /** User ID extracted from token (if valid) */
  userId?: string;
  /** Instance ID that issued the token (if valid) */
  instanceId?: string;
  /** Workspace ID from token context (if valid) */
  workspaceId?: string;
  /** Email from token claims (if valid) */
  email?: string;
  /** OIDC subject identifier (if valid) */
  subject?: string;
  /** Error message if validation failed */
  error?: string;
}

/**
 * Federated identity mapping
 */
export interface FederatedIdentity {
  /** Internal UUID */
  id: string;
  /** Local user ID */
  localUserId: string;
  /** Remote user ID on the federated instance */
  remoteUserId: string;
  /** Remote instance federation ID */
  remoteInstanceId: string;
  /** OIDC subject identifier */
  oidcSubject: string;
  /** User's email address */
  email: string;
  /** Additional metadata */
  metadata: Record<string, unknown>;
  /** Creation timestamp */
  createdAt: Date;
  /** Last update timestamp */
  updatedAt: Date;
}

/**
 * DTO for initiating federated auth flow
 */
export interface InitiateFederatedAuthDto {
  /** Remote instance ID to authenticate with */
  remoteInstanceId: string;
  /** Optional: Redirect URL after authentication */
  redirectUrl?: string;
}

/**
 * DTO for linking federated identity
 */
export interface LinkFederatedIdentityDto {
  /** Remote instance ID */
  remoteInstanceId: string;
  /** Remote user ID */
  remoteUserId: string;
  /** OIDC subject identifier */
  oidcSubject: string;
  /** User's email */
  email: string;
  /** Optional metadata */
  metadata?: Record<string, unknown>;
}

/**
 * DTO for validating federated token
 */
export interface ValidateFederatedTokenDto {
  /** OIDC access token or ID token */
  token: string;
  /** Instance ID that issued the token */
  instanceId: string;
}

/**
 * Response for federated auth initiation
 */
export interface FederatedAuthInitiationResponse {
  /** Authorization URL to redirect user to */
  authUrl: string;
  /** State parameter for CSRF protection */
  state: string;
}

/**
 * OIDC token claims
 */
export interface OIDCTokenClaims {
  /** Subject (user ID) */
  sub: string;
  /** Issuer */
  iss: string;
  /** Audience */
  aud: string;
  /** Expiration time (Unix timestamp) */
  exp: number;
  /** Issued at time (Unix timestamp) */
  iat: number;
  /** Email */
  email?: string;
  /** Email verified */
  email_verified?: boolean;
  /** Name */
  name?: string;
  /** Preferred username */
  preferred_username?: string;
  /** Custom claims */
  [key: string]: unknown;
}
