import { z } from 'zod';

// Contrato do auth dev stub — POST /api/v1/auth/dev/token.
// Endpoint existe APENAS em development/test (NODE_ENV !== 'production').
// CODING-RULES PGD-SEC-002: never use dev secret in production.

const JwtRoleSchema = z.enum(['rep', 'supervisor', 'manager', 'admin']);

export const DevTokenRequestSchema = z.object({
  userId: z.string().min(1),
  workspaceId: z.string().min(1),
  role: JwtRoleSchema,
});

export const AuthTokenResponseSchema = z.object({
  accessToken: z.string().min(1),
  tokenType: z.literal('Bearer'),
  expiresIn: z.number().int().positive(),
});

export type DevTokenRequest = z.infer<typeof DevTokenRequestSchema>;
export type AuthTokenResponse = z.infer<typeof AuthTokenResponseSchema>;
export type JwtRole = z.infer<typeof JwtRoleSchema>;
