import type { OidcConfig, OidcUserContext, OidcFeatures } from "ioserver-oidc";

interface OidcConfig {
  /** Public base URL of auth-service. Example: "https://auth.example.com" */
  readonly authServiceUrl: string;

  /** OAuth2 client_id / application slug. Used to validate the `azp` (authorized party) claim. */
  readonly appSlug: string;

  /** Override the JWKS URI. Defaults to "<authServiceUrl>/api/auth/jwks". */
  readonly jwksUri?: string;

  /** Override the expected `iss` claim. Defaults to authServiceUrl. */
  readonly issuer?: string;

  /**
   * Expected `aud` claim (RFC 8707 resource mode). When set to a resource URL
   * that differs from `appSlug`, the `azp` claim becomes mandatory.
   * Defaults to `appSlug` for backward compatibility.
   */
  readonly audience?: string;

  /**
   * Allow-list of JWS algorithms. Defaults to asymmetric only
   * (`RS*`, `PS*`, `ES*`, `EdDSA`); `HS*` and `none` are excluded.
   */
  readonly algorithms?: readonly string[];
}

interface OidcUserContext {
  /** Internal user ID — local DB record (after findOrCreate); falls back to sub. */
  userId: string;

  /** OIDC sub claim — stable auth-service user identifier. */
  sub: string;

  /** Email from JWT `email` claim. Null if the claim is absent. */
  email: string | null;

  /** Display name from JWT `name` claim. Null if the claim is absent. */
  name: string | null;

  /** Primary role — roles[0] or "user" when roles is empty. */
  userRole: string;

  /** Full roles array from the JWT `roles` claim. */
  roles: string[];

  /** Permission strings from the JWT `permissions` claim. */
  permissions: string[];

  /** Feature flags and limits from the JWT `features` claim. */
  features: OidcFeatures;

  /** Active organization ID from the JWT `org_id` claim. Present only when the `org` scope was requested. */
  org_id?: string;
}

type OidcFeatures = Record<string, unknown>;

import type { OidcFeatures } from "ioserver-oidc";

interface AppFeatures extends OidcFeatures {
  maxProjects: number;
  canExport: boolean;
  tier: "free" | "pro" | "enterprise";
}

// In a controller or service:
const features = request.features as AppFeatures;
if (!features.canExport) {
  reply.code(403).send({ error: "Export not available on your plan" });
}

// src/types/ioserver-oidc.d.ts
import "fastify";
import type { OidcFeatures } from "ioserver-oidc";

declare module "fastify" {
  interface FastifyRequest {
    sub: string;
    userId: string;
    userRole: string;
    roles: string[];
    permissions: string[];
    features: OidcFeatures;
  }
}

declare module "socket.io" {
  interface Socket {
    sub: string;
    userId: string;
    userRole: string;
    roles: string[];
    permissions: string[];
    features: OidcFeatures;
  }
}