/**
 * ae_stores__auth_loc_defaults.ts
 *
 * Authentication and identity defaults for the ae_loc persisted store.
 * Spread into ae_app_local_data_defaults via ae_stores.ts — zero consumer
 * changes needed; all $ae_loc.* paths remain unchanged.
 *
 * Three authentication paths share this store region:
 *   1. Site passcode     — site_access_code_kv, access_type, *_access flags
 *   2. AE user/password  — jwt, user{}, user_id
 *   3. Resolved identity — person{}, person_id (populated after either path)
 *
 * See documentation/AE__Permissions_and_Security.md for the full hierarchy.
 */

export interface SiteCfgJson {
    slct__event_id: string | null;
    slct__event_badge_template_id: string | null;
    slct__sponsorship_cfg_id: string | null;
    header_image_path: string | null;
    [key: string]: any; // Server may add further site-specific fields.
}

export interface AePerson {
    id: string | null;
    given_name: string | null;
    full_name: string | null;
    full_name_override: string | null; // Previously called display_name.
    primary_email: string | null;
    user_id: string | null;
    qry_limit__people: number;
    show_content__person_page_help: boolean;
    [key: string]: any; // API may populate additional person fields.
}

export interface AeUser {
    id: string | null;
    username: string | null;
    name: string | null;
    email: string | null;
    allow_auth_key: string | null; // Magic-link token — allows sign-in without password.
    super: boolean;
    manager: boolean; // Can manage accounts and users globally.
    administrator: boolean; // Account-level administrator.
    verified: boolean;
    public: boolean;
    person_id: string | null;
    access_type: string | null;
    qry_limit__users: number;
    [key: string]: any; // API may populate additional user fields.
}

export type AccessType =
    | 'anonymous'
    | 'public'
    | 'authenticated'
    | 'trusted'
    | 'administrator';

export interface AuthLocState {
    account_id: string | null;
    account_code: string;
    account_name: string;
    // true when no site passcode is required; string = the access key that was used.
    allow_access: boolean | string;
    site_domain: string | null;
    site_access_key: string | null;
    site_domain_access_key: string | null;
    site_cfg_json: SiteCfgJson;
    site_access_code_kv: {
        administrator: string | null;
        trusted: string | null;
        public: string | null;
        authenticated: string | null;
    };
    access_type: AccessType;
    administrator_access: boolean;
    trusted_access: boolean;
    public_access: boolean;
    authenticated_access: boolean;
    anonymous_access: boolean;
    user_email: string | null;
    user_access_type: string | null;
    jwt: string | null;
    person_id: string | null;
    person: AePerson;
    user_id: string | null;
    user: AeUser;
}

export const auth_loc_defaults: AuthLocState = {
    // account_id is always null at module init — the env var is intentionally not
    // read here; the value is set from the site API after the first trusted login.
    account_id: null,
    account_code: 'not_set',
    account_name: 'Account Name Not Set',

    // Set to the site access key used for login, or true if no site passcode is required.
    allow_access: true,

    site_domain: null, // e.g. https://example.com, https://dev.example.com
    site_access_key: null, // General site access key.
    site_domain_access_key: null, // Subdomain-specific access key.
    site_cfg_json: {
        slct__event_id: null,
        slct__event_badge_template_id: null,
        slct__sponsorship_cfg_id: null,
        header_image_path: null
    },

    // Per-permission-level passcodes loaded from the site record on login.
    // null = no passcode required for that tier. Overwritten by the site API response.
    site_access_code_kv: {
        administrator: null,
        trusted: null,
        public: 'public1980',
        authenticated: 'auth1980'
    },

    // Current permission level. Updated by ae_utils__perm_checks after any auth event.
    // Values: 'anonymous' | 'public' | 'authenticated' | 'trusted' | 'administrator'
    access_type: 'anonymous',
    // Cumulative flags — true means "you have AT LEAST this access level."
    administrator_access: false,
    trusted_access: false,
    public_access: false,
    authenticated_access: false,
    anonymous_access: true,

    user_email: null,
    // Stored on sign-in so the original permission level can be restored if temporarily escalated.
    user_access_type: null,

    jwt: null, // JSON Web Token for authenticated API requests.

    // Resolved person identity — populated after either auth path.
    person_id: null,
    person: {
        id: null,
        given_name: null,
        full_name: null,
        full_name_override: null, // Previously called display_name.
        primary_email: null,
        user_id: null,
        qry_limit__people: 150,
        show_content__person_page_help: false
    },

    // AE user account — only populated for AE username/password login.
    user_id: null,
    user: {
        id: null,
        username: null,
        name: null,
        email: null,
        allow_auth_key: null, // Magic-link token — allows sign-in without password.
        super: false,
        manager: false, // Can manage accounts and users globally.
        administrator: false, // Account-level administrator.
        verified: false,
        public: false,
        person_id: null,
        access_type: null,
        qry_limit__users: 100
    }
};
