/**
 * Authentication-related type definitions
 * Shared between frontend and backend for type safety
 */

/**
 * Authenticated user information
 * This is the subset of user data that's safe to expose to the client
 */
export interface AuthUser {
  readonly id: string;
  email: string;
  name: string;
  image?: string;
  emailVerified?: boolean;
  /**
   * @deprecated Never populated by BetterAuth session. Workspace context is
   * fetched separately via GET /api/workspaces. Will be removed in a future pass.
   */
  workspaceId?: string;
  /** @deprecated See workspaceId. */
  currentWorkspaceId?: string;
  /** @deprecated See workspaceId. */
  workspaceRole?: string;
}

/**
 * Session information
 */
export interface Session {
  readonly id: string;
  userId: string;
  token: string;
  expiresAt: Date;
  ipAddress?: string;
  userAgent?: string;
  readonly createdAt: Date;
  updatedAt: Date;
}

/**
 * OAuth account information
 */
export interface Account {
  readonly id: string;
  userId: string;
  accountId: string;
  providerId: string;
  accessToken?: string;
  refreshToken?: string;
  idToken?: string;
  accessTokenExpiresAt?: Date;
  refreshTokenExpiresAt?: Date;
  scope?: string;
  readonly createdAt: Date;
  updatedAt: Date;
}

/**
 * Session data returned from authentication
 * This is what the frontend receives after successful authentication
 */
export interface AuthSession {
  user: AuthUser;
  session: {
    id: string;
    token: string;
    expiresAt: Date;
  };
}

/**
 * Login request payload
 */
export interface LoginRequest {
  email: string;
  password: string;
}

/**
 * Login response
 */
export interface LoginResponse {
  accessToken: string;
  user: AuthUser;
}

/**
 * OAuth provider types
 */
export type OAuthProvider = "authentik" | "google" | "github";

/**
 * OAuth callback query parameters
 */
export interface OAuthCallbackParams {
  code: string;
  state?: string;
  error?: string;
  error_description?: string;
}

/**
 * Auth provider type advertised by the backend via GET /auth/config
 */
export interface AuthProviderConfig {
  id: string;
  name: string;
  type: "oauth" | "credentials";
}

/**
 * Response shape for GET /auth/config
 * Backend advertises available auth methods for the frontend to render dynamically.
 */
export interface AuthConfigResponse {
  providers: AuthProviderConfig[];
}
