import { z } from 'zod';

// Contrato do auth dev stub — POST /api/v1/auth/dev/token.
// Endpoint existe APENAS em development/test (NODE_ENV !== 'production').
// CODING-RULES PGD-SEC-002: never use dev secret in production.
// ADR 0006 revogado: workspaceId: string → idEmpresa: number (empresa no ERP)

const JwtRoleSchema = z.enum(['rep', 'supervisor', 'manager', 'admin']);

export const DevTokenRequestSchema = z.object({
  userId: z.string().min(1),
  // Opcional: quando ausente, o backend usa DEV_EMPRESA_ID do .env
  idEmpresa: z.coerce.number().int().positive().optional(),
  role: JwtRoleSchema,
});

export const AuthTokenResponseSchema = z.object({
  accessToken: z.string().min(1),
  tokenType: z.literal('Bearer'),
  expiresIn: z.number().int().positive(),
});

export const UserProfileSchema = z.object({
  codVendedor: z.number().int(),
  nome: z.string(),
  role: JwtRoleSchema,
  idEmpresa: z.number().int(),
});

export type DevTokenRequest = z.infer<typeof DevTokenRequestSchema>;
export type AuthTokenResponse = z.infer<typeof AuthTokenResponseSchema>;
export type JwtRole = z.infer<typeof JwtRoleSchema>;
export type UserProfile = z.infer<typeof UserProfileSchema>;
