using ERPCore.Dtos.Auth;

namespace ERPCore.Infra.Auth.AuthHex;

/// <summary>
/// Typed client for the external AuthHex identity service (API_REFERENCE.md).
/// Hides AuthHex's `functionName` dispatcher entirely — callers get one method
/// per function. Internal: only Services/Auth consumes this; the controller
/// boundary only ever sees Dtos/Auth types.
/// </summary>
public interface IAuthHexClient
{
    // UserManager (POST /api/user)
    Task<AuthHexSessionResult> RegisterAsync(RegisterRequest request, CancellationToken ct);
    Task<AuthHexSessionResult> LoginAsync(LoginRequest request, CancellationToken ct);
    Task<AuthHexSessionResult> VerifyOtpForLoginAsync(VerifyOtpForLoginRequest request, CancellationToken ct);
    Task<AuthHexSessionResult> RefreshTokenAsync(string refreshToken, string? deviceName, CancellationToken ct);
    Task<GetUserDetailsResponse> GetUserDetailsAsync(Guid userId, CancellationToken ct);
    Task<List<UserTypeDto>> ListUserTypesAsync(CancellationToken ct);
    Task<List<SessionDto>> GetUserSessionsAsync(string bearerToken, CancellationToken ct);
    Task ChangeUserStatusAsync(bool isActive, string bearerToken, CancellationToken ct);
    Task LockUserAccountAsync(bool isLocked, string bearerToken, CancellationToken ct);
    Task ChangeUserPasswordAsync(ChangeUserPasswordRequest request, string bearerToken, CancellationToken ct);
    Task<VerifyPasswordResponse> VerifyPasswordAsync(VerifyPasswordRequest request, string bearerToken, CancellationToken ct);
    Task LogoutUserAsync(Guid userId, CancellationToken ct);
    Task<UserSummaryDto?> UpdateUserAsync(UpdateUserRequest request, string bearerToken, CancellationToken ct);
    Task<TwoFaSetupResponse> InitiateTwoFaSetupAsync(string bearerToken, CancellationToken ct);
    Task<CompleteTwoFaSetupResponse> CompleteTwoFaSetupAsync(CompleteTwoFaSetupRequest request, string bearerToken, CancellationToken ct);
    Task VerifyTwoFaAsync(VerifyTwoFaRequest request, string bearerToken, CancellationToken ct);
    Task DisableTwoFaAsync(DisableTwoFaRequest request, string bearerToken, CancellationToken ct);
    Task<TwoFaStatusResponse> GetTwoFaStatusAsync(string bearerToken, CancellationToken ct);

    // RecoveryManager (POST /api/recovery)
    Task<ForgotPasswordResponse> ForgotPasswordAsync(ForgotPasswordRequest request, CancellationToken ct);
    Task<VerifyRecoveryOtpResponse> VerifyRecoveryOtpAsync(VerifyRecoveryOtpRequest request, CancellationToken ct);
    Task ResetPasswordAsync(ResetPasswordRequest request, CancellationToken ct);
    Task ResetPasswordWithTokenAsync(ResetPasswordWithTokenRequest request, CancellationToken ct);

    // AltOptionManager (POST /api/alt)
    Task<IsAvailableResponse> IsAvailableAsync(IsAvailableRequest request, CancellationToken ct);
    Task<SendOtpResponse> SendOtpAsync(SendOtpRequest request, CancellationToken ct);
    Task<AuthHexSessionResult> VerifyAltOtpAsync(VerifyAltOtpRequest request, CancellationToken ct);

    // RoleManager (POST /api/role) — AuthHex is the source of truth for Role;
    // ERPCore mirrors the result into a local shadow Role row (see RoleService).
    Task<AuthHexRoleDto> CreateRoleAsync(CreateAuthHexRoleRequest request, CancellationToken ct);
    Task<List<AuthHexRoleDto>> ListRolesAsync(CancellationToken ct);
    Task<AuthHexRoleDto> GetRoleAsync(Guid roleId, CancellationToken ct);
    Task<AuthHexRoleDto> UpdateRoleAsync(UpdateAuthHexRoleRequest request, CancellationToken ct);
    Task DeleteRoleAsync(Guid roleId, CancellationToken ct);
}
