/**
 * Wire types for the /v1/tenants/{id}/sources/* endpoints. Mirrors
 * the Go authd.Source struct in internal/authd/sources.go.
 *
 * Notes on the secrets contract:
 *   - The wire shape NEVER includes the plaintext HMAC secret or
 *     API key. It only carries booleans (`hmac_set`, `api_key_set`)
 *     that tell the UI whether the operator has configured a
 *     secret for this source.
 *   - The plaintext values are returned ONCE at create / rotate
 *     time, in a `SecretsPayload` (see CreateSourceResponse). The
 *     UI shows them in a "you have to save these now" modal and
 *     then never sees them again.
 */

export type SourceType = 'http' | 'mqtt' | 'ws' | 'grpc';

export type SourceStatus = 'active' | 'suspended';

export interface Source {
  id: string;
  company_id: string;
  name: string;
  type: SourceType;
  rate_limit_per_sec: number;
  /** JSONB: a list of { type: 'group'|'individual', id: string }. */
  allowed_targets: unknown;
  /** JSONB: free-form match expression. */
  match_expr: unknown;
  status: SourceStatus;
  mtls_required: boolean;
  description?: string;
  hmac_set: boolean;
  api_key_set: boolean;
  created_at: string; // RFC3339 from the server
}

export interface ListSourcesResponse {
  items: Source[];
  total: number;
  limit: number;
  offset: number;
}

export interface CreateSourceInput {
  id: string;
  name: string;
  type: SourceType;
  rate_limit_per_sec: number;
  description?: string;
  mtls_required?: boolean;
  allowed_targets?: unknown;
  match_expr?: unknown;
  /** Plaintext. Hash on the server; returned in the response. */
  hmac_secret?: string;
  /** Plaintext. Hash on the server; returned in the response. */
  api_key?: string;
}

export interface UpdateSourceInput {
  name?: string;
  type?: SourceType;
  rate_limit_per_sec?: number;
  description?: string;
  mtls_required?: boolean;
  allowed_targets?: unknown;
  match_expr?: unknown;
}

export interface SecretsPayload {
  hmac_secret: string;
  api_key: string;
}

/** Wire shape of POST /v1/tenants/{id}/sources and /rotate-secrets. */
export interface CreateOrRotateResponse {
  source: Source;
  /** Omitted when no secrets were generated. */
  secrets?: SecretsPayload;
}
