export interface AuthUser {
  id: string;
  name: { am: string; en: string };
  email: string;
  roles: string[];
  status: string;
  employee: any[];
  userType: string;
  username: string;
  permissions: string[];
  phoneNumber: string;
  sharepointId: string | null;
  hasSetPassword: boolean;
  hasFinishedRegistration: boolean;
  hasFinishedDMSOnboarding: boolean;
}

export interface SignupPayload {
  email: string;
  username: string;
  phoneNumber: string;
  userType: string;
  name: { en: string; am: string };
  password: string;
  confirmPassword: string;
}

export interface SignupResponse {
  token: string;
  refreshToken: string;
  otp: string;
  userId: string;
}

export interface OtpPayload {
  /**
   * At least one of phone/email. Send both and the API delivers one code to
   * both, verifiable by quoting either back.
   */
  phone?: string;
  email?: string;
  /** Required on verify; omitted on send (the server generates the code). */
  otp?: string;
}

export interface OtpResponse {
  success: boolean;
  message: string;
}

/**
 * Change the signed-in user's password. The old password is the proof of
 * possession — IAM verifies it server-side and owns the credential write, so the
 * freight app never hashes or stores a password itself.
 */
export interface ChangePasswordPayload {
  oldPassword: string;
  newPassword: string;
  confirmPassword: string;
}

/** The contact channel being changed on the signed-in user's own account. */
export type ContactChannel = "email" | "phone";

export interface SendContactOtpPayload {
  channel: ContactChannel;
  /** The NEW value being moved to — the code is sent here, not to the old one. */
  value: string;
}

export interface SendContactOtpResponse {
  /** Masked hint of where the code landed, e.g. `+251•••••4567`. */
  sentTo: string;
}

export interface UpdateContactPayload extends SendContactOtpPayload {
  otp: string;
}

export interface UpdateContactResponse {
  success: true;
  /** The canonical stored value (E.164 for phone, lowercased for email). */
  value: string;
}

export interface UpdateAccountNamePayload {
  name: { am: string; en?: string };
}

export interface CheckAvailabilityPayload {
  email?: string;
  phone?: string;
}

export interface CheckAvailabilityResponse {
  emailTaken: boolean;
  phoneTaken: boolean;
}

export interface SetPasswordPayload {
  newPassword: string;
  confirmPassword: string;
  userId: string;
  email: string;
  verificationCode: string;
}

export interface ForgotPasswordRequestPayload {
  /** Email, username, or E.164 phone — whatever the user typed, normalised. */
  identifier: string;
}

export interface ForgotPasswordVerifyPayload extends ForgotPasswordRequestPayload {
  otp: string;
}

/** Single-use ticket to spend on `PATCH /api/auth/set-password`. */
export interface ResetTicket {
  userId: string;
  verificationCode: string;
}

/** The `uid` / `token` pair carried by a staff-issued password-reset link. */
export interface ResolveResetLinkPayload {
  userId: string;
  token: string;
}

/**
 * A validated reset link. Carries the identifier IAM matches the account on, so
 * the customer never has to type one — plus a masked copy safe to display.
 */
export interface ResetLinkAccount extends ResetTicket {
  identifier: string;
  maskedIdentifier: string;
}

export interface GenerateVerificationCodePayload {
  email: string;
  phoneNumber: string;
  type: string;
}

export interface LoginPayload {
  email: string;
  password: string;
}

export interface LoginResponse {
  token: string;
  refreshToken: string;
}
