/**
 * Federation Identity Linking Types
 *
 * Types for cross-instance user identity verification and resolution.
 */

/**
 * Request to verify a user's identity from a remote instance
 */
export interface IdentityVerificationRequest {
  /** Local user ID on this instance */
  localUserId: string;
  /** Remote user ID on the originating instance */
  remoteUserId: string;
  /** Remote instance federation ID */
  remoteInstanceId: string;
  /** OIDC token for authentication */
  oidcToken: string;
  /** Request timestamp (Unix milliseconds) */
  timestamp: number;
  /** Request signature (signed by remote instance private key) */
  signature: string;
}

/**
 * Response from identity verification
 */
export interface IdentityVerificationResponse {
  /** Whether the identity was verified successfully */
  verified: boolean;
  /** Local user ID (if verified) */
  localUserId?: string;
  /** Remote user ID (if verified) */
  remoteUserId?: string;
  /** Remote instance ID (if verified) */
  remoteInstanceId?: string;
  /** User's email (if verified) */
  email?: string;
  /** Error message if verification failed */
  error?: string;
}

/**
 * Request to resolve a remote user to a local user
 */
export interface IdentityResolutionRequest {
  /** Remote instance federation ID */
  remoteInstanceId: string;
  /** Remote user ID to resolve */
  remoteUserId: string;
}

/**
 * Response from identity resolution
 */
export interface IdentityResolutionResponse {
  /** Whether a mapping was found */
  found: boolean;
  /** Local user ID (if found) */
  localUserId?: string;
  /** Remote user ID */
  remoteUserId?: string;
  /** Remote instance ID */
  remoteInstanceId?: string;
  /** User's email (if found) */
  email?: string;
  /** Additional metadata */
  metadata?: Record<string, unknown>;
}

/**
 * Request to reverse resolve a local user to a remote identity
 */
export interface ReverseIdentityResolutionRequest {
  /** Local user ID to resolve */
  localUserId: string;
  /** Remote instance federation ID */
  remoteInstanceId: string;
}

/**
 * Request for bulk identity resolution
 */
export interface BulkIdentityResolutionRequest {
  /** Remote instance federation ID */
  remoteInstanceId: string;
  /** Array of remote user IDs to resolve */
  remoteUserIds: string[];
}

/**
 * Response for bulk identity resolution
 */
export interface BulkIdentityResolutionResponse {
  /** Map of remoteUserId -> localUserId */
  mappings: Record<string, string>;
  /** Remote user IDs that could not be resolved */
  notFound: string[];
}

/**
 * DTO for creating identity mapping
 */
export interface CreateIdentityMappingDto {
  /** Remote instance ID */
  remoteInstanceId: string;
  /** Remote user ID */
  remoteUserId: string;
  /** OIDC subject identifier */
  oidcSubject: string;
  /** User's email */
  email: string;
  /** Optional metadata */
  metadata?: Record<string, unknown>;
  /** Optional: OIDC token for validation */
  oidcToken?: string;
}

/**
 * DTO for updating identity mapping
 */
export interface UpdateIdentityMappingDto {
  /** Updated metadata */
  metadata?: Record<string, unknown>;
}

/**
 * Identity mapping validation result
 */
export interface IdentityMappingValidation {
  /** Whether the mapping is valid */
  valid: boolean;
  /** Local user ID (if valid) */
  localUserId?: string;
  /** Remote user ID (if valid) */
  remoteUserId?: string;
  /** Remote instance ID (if valid) */
  remoteInstanceId?: string;
  /** Error message if invalid */
  error?: string;
}
