interface LocaleText {
  en?: string;
  am?: string;
}

interface AuthRole {
  id?: string;
  key?: string;
}

interface AuthPermission {
  id?: string;
  key?: string;
}

interface AuthEmployeePosition {
  id?: string;
  employeePositionId?: string;
  name?: LocaleText;
  key?: string;
  isDelegate?: boolean;
  parentPositionId?: string | null;
  permissions?: AuthPermission[];
  /** Some IAM payloads nest the position record instead of flattening its key. */
  position?: { id?: string; key?: string; name?: LocaleText };
  positionType?: { id?: string; key?: string; name?: LocaleText } | null;
}

interface AuthEmployeeRecord {
  id?: string;
  organizationId?: string;
  unitId?: string;
  name?: LocaleText;
  positions?: AuthEmployeePosition[];
}

export interface AuthUser {
  id?: string;
  email?: string;
  username?: string;
  phoneNumber?: string;
  name?: LocaleText;
  roles?: AuthRole[];
  permissions?: AuthPermission[];
  /** Flat keys from GET /api/me (roles + position permissions). */
  permissionKeys?: string[];
  isSuperAdmin?: boolean;
  employee?: AuthEmployeeRecord[];
  hasSetPassword?: boolean;
  status?: string;
}

export interface AuthTokens {
  token: string;
  refreshToken: string;
}

export interface LoginResponse extends Partial<AuthTokens> {
  mfaRequired?: boolean;
}

export interface ForgotPasswordRequestPayload {
  /** Email, username, or E.164 phone — whatever the user typed, normalised. */
  identifier: string;
}

export interface ForgotPasswordVerifyPayload extends ForgotPasswordRequestPayload {
  otp: string;
}

/** Single-use ticket to spend on `PATCH /api/auth/set-password`. */
export interface ResetTicket {
  userId: string;
  verificationCode: string;
}

export interface SetPasswordPayload {
  newPassword: string;
  confirmPassword: string;
  userId: string;
  email: string;
  verificationCode: string;
}

// Additional types for Matrix form test
export interface User {
  id: string;
  name: string;
  role: "ADMIN" | "MANAGER" | "CHIEF_EXECUTIVE";
}
