// Typed calls for the phase 1 endpoints. Paths and shapes follow the design contract.
import { api } from "../api/client";
import type {
  AccessLogRow,
  AccountInfo,
  AdLookup,
  AdminDevice,
  AdminUser,
  AdminUserDetail,
  AuthContextInfo,
  Department,
  DeviceRef,
  Factor,
  GroupMap,
  Me,
  PinState,
  SessionRow,
  SigninAttempt,
} from "./types";

const enc = encodeURIComponent;

export const authApi = {
  context: (signal?: AbortSignal) => api.get<AuthContextInfo>("/api/auth/context", signal),
  me: (signal?: AbortSignal) => api.get<Me>("/api/auth/me", signal),
  signInPassword: (login: string, password: string) =>
    api.post<Me>("/api/auth/signin/password", { login, password }),
  signInPin: (emp_no: string, pin: string) => api.post<Me>("/api/auth/signin/pin", { emp_no, pin }),
  signOut: () => api.post<null>("/api/auth/signout"),
  lock: () => api.post<null>("/api/auth/lock"),
  visibility: (hidden: boolean) => api.post<null>("/api/auth/visibility", { hidden }),
  unlock: (factor: Factor, secret: string) => api.post<Me>("/api/auth/unlock", { factor, secret }),
};

export const accountApi = {
  get: (signal?: AbortSignal) => api.get<AccountInfo>("/api/account", signal),
  setPin: (password: string, pin: string) =>
    api.post<{ pin: PinState }>("/api/account/pin", { password, pin }),
  sessions: (signal?: AbortSignal) => api.get<SessionRow[]>("/api/account/sessions", signal),
  signOutOthers: () => api.post<{ revoked: number }>("/api/account/sessions/signout-others"),
  accessLog: (limit = 50, signal?: AbortSignal) =>
    api.get<AccessLogRow[]>(`/api/account/access-log?limit=${limit}`, signal),
  registerDevice: (name: string) => api.post<{ device: DeviceRef }>("/api/account/device", { name }),
};

export const adminApi = {
  users: (q: string, signal?: AbortSignal) =>
    api.get<AdminUser[]>(q ? `/api/admin/users?q=${enc(q)}` : "/api/admin/users", signal),
  user: (id: string, signal?: AbortSignal) => api.get<AdminUserDetail>(`/api/admin/users/${enc(id)}`, signal),
  lookup: (login: string, signal?: AbortSignal) =>
    api.get<AdLookup>(`/api/admin/ad/lookup?login=${enc(login)}`, signal),
  clearPin: (id: string, reason: string) =>
    api.delWithBody<null>(`/api/admin/users/${enc(id)}/pin`, { reason }),
  devices: (signal?: AbortSignal) => api.get<AdminDevice[]>("/api/admin/devices", signal),
  revokeDevice: (id: string) => api.del<null>(`/api/admin/devices/${enc(id)}`),
  groups: (signal?: AbortSignal) => api.get<GroupMap>("/api/admin/groups", signal),
  signinAttempts: (limit = 100, signal?: AbortSignal) =>
    api.get<SigninAttempt[]>(`/api/admin/signin-attempts?limit=${limit}`, signal),
};

export const departmentsApi = {
  list: (signal?: AbortSignal) => api.get<Department[]>("/api/departments", signal),
};