// ─────────────────────────────────────────────────────────────────────────────
// Documents module — types (matches backend documents module DTOs / entities).
// ─────────────────────────────────────────────────────────────────────────────

export type DocumentStatus = 'active' | 'archived';

export type DocumentAction =
  | 'viewed'
  | 'downloaded'
  | 'otp_sent'
  | 'otp_failed'
  | 'password_failed'
  | 'denied';

// Role-assignment shape returned inside a document row
export interface DocumentRoleAssignment {
  id: number;
  document_id: number;
  role_id: number;
  role_name: string | null;
  assigned_by: number;
  created_at: string;
}

// One document row returned by GET /documents
export interface DocumentRow {
  id: number;
  title: string;
  category: string;
  description: string | null;
  file_path: string;
  file_name: string;
  file_size: number | null;
  mime_type: string | null;
  password_hash: string | null;    // present (as string) means password is set
  require_otp: number;              // 0 / 1
  allow_download: number;           // 0 / 1
  expiry_date: string | null;       // YYYY-MM-DD
  status: DocumentStatus;
  uploaded_by: number;
  created_at: string;
  updated_at: string;

  // Relations
  role_assignments?: DocumentRoleAssignment[];

  // Attached by the service for admin listings
  open_count?: number;
  failed_count?: number;
}

// GET /documents wrapper
export interface DocumentsListResponse {
  data: DocumentRow[];
  meta: {
    total: number;
    page: number;
    limit: number;
    totalPages: number;
  };
}

// GET /documents/analytics
export interface DocumentsAnalytics {
  total_docs: number;
  active_docs: number;
  total_opens: number;
  failed_attempts: number;
}

// One access-log row returned by GET /documents/:id/access-log
export interface AccessLogEntry {
  id: number;
  document_id: number;
  user_id: number;
  user_name: string | null;
  role_name: string | null;
  action: DocumentAction;
  ip_address: string | null;
  user_agent: string | null;
  created_at: string;
}

export interface AccessLogResponse {
  data: AccessLogEntry[];
  meta: {
    total: number;
    page: number;
    limit: number;
    totalPages: number;
  };
}

// One user returned by GET /documents/roles/users — used to build the
// "who gets notified" checklist once role(s) are picked in the upload modal.
export interface RoleMember {
  id: number;
  name: string;
  email: string;
  role_id: number;
}

// Body payloads (kept loose — backend DTOs validate)
export interface UploadDocumentPayload {
  title: string;
  category: string;
  description?: string;
  role_ids: number[];
  /** Subset of role members to email. Omit to notify everyone in role_ids. */
  notify_user_ids?: number[];
  require_otp?: boolean;
  allow_download?: boolean;
  password?: string;
  expiry_date?: string;
  file: File;
}

export interface UpdateDocumentPayload {
  title?: string;
  category?: string;
  description?: string;
  role_ids?: number[];
  require_otp?: boolean;
  allow_download?: boolean;
  password?: string;
  expiry_date?: string | null;
  status?: DocumentStatus;
}

export interface UnlockResponse {
  token: string;
  view_url: string;
  download_url: string | null;
  expires_in_minutes: number;
}

// Filter state used by the page (mirrors MyAuditsFilters shape)
export interface DocumentsFilters {
  search: string;
  category: string;      // 'all' or a category name
  status: DocumentStatus | 'all';
  roleId: number | 'all';
}