import type { Session, User } from '@supabase/supabase-js';

/**
 * Authenticator Assurance Levels (AAL)
 * - aal1: Basic authentication (password/OAuth/magic link)
 * - aal2: Multi-factor authentication completed
 */
export type AALLevel = 'aal1' | 'aal2';

/**
 * MFA Factor types supported by Supabase
 */
export type MFAFactorType = 'totp';

/**
 * MFA Factor status
 */
export type MFAFactorStatus = 'verified' | 'unverified';

/**
 * MFA Factor structure from Supabase
 */
export interface MFAFactor {
  id: string;
  factor_type: MFAFactorType;
  status: MFAFactorStatus;
  friendly_name?: string;
  created_at: string;
  updated_at: string;
}

/**
 * Result of AAL step-up check
 */
export interface CheckAalResult {
  needsStepUp: boolean;
  hasMfaEnrolled: boolean;
  currentLevel: AALLevel | null;
  hasEnrolledFactors?: boolean;
  factorId?: string;
}

/**
 * Authentication method types
 */
export type AuthMethod = 'password' | 'oauth' | 'magiclink';

/**
 * Authentication session with AAL information
 */
export interface AuthSessionInfo {
  session: Session | null;
  user: User | null;
  aal: AALLevel;
  authMethod?: AuthMethod;
}

/**
 * MFA Challenge result
 */
export interface MFAChallengeResult {
  success: boolean;
  error?: string;
  newAal?: AALLevel;
}

/**
 * Auth service response
 */
export interface AuthServiceResponse<T = void> {
  success: boolean;
  data?: T;
  error?: string;
}

/**
 * Authentication session from Supabase with hashed IP
 */
export interface AuthSession {
  id: string;
  created_at: string;
  updated_at: string;
  refreshed_at: string | null;
  user_agent: string | null;
  ip: string | null; // Pre-hashed by database function
  not_after: string | null;
  aal: string | null; // Changed to string to match get_my_sessions() return type
}

/**
 * Security-sensitive operations that may require additional verification
 */
export type SecurityOperation =
  | 'password_change'
  | 'identity_disconnect'
  | 'identity_connect'
  | 'session_revoke'
  | 'mfa_enroll'
  | 'mfa_unenroll';

/**
 * Rate limit information for security operations
 */
export interface RateLimitInfo {
  operation: SecurityOperation;
  allowed: boolean;
  attemptsRemaining: number;
  resetAt: Date;
  currentAttempts: number;
  maxAttempts: number;
}

/**
 * Security operation context for logging
 */
export interface SecurityContext {
  operation: SecurityOperation;
  userId?: string;
  targetUserId?: string;
  requiresMFA?: boolean;
  metadata?: Record<string, any>;
}
