import { z } from 'zod';

/**
 * OIDC SSO contract for /api/auth/oidc.
 *
 * The flow is redirect-based and carries no request bodies — inputs arrive as
 * query params (the provider callback's code/state/error, the optional invite on
 * /login, and the auth-code on /exchange). These schemas pin those query shapes;
 * the cryptographic verification + provisioning live in the OIDC service.
 */
export const oidcLoginQuerySchema = z.object({
  invite: z.string().optional(),
  // '1' → remember-me session (SESSION_DURATION_REMEMBER), '0' → browser-session
  // cookie, absent → the historical default duration. String flags because the
  // value survives a redirect query, not a JSON body.
  remember: z.enum(['0', '1']).optional(),
});
export type OidcLoginQuery = z.infer<typeof oidcLoginQuerySchema>;

export const oidcCallbackQuerySchema = z.object({
  code: z.string().optional(),
  state: z.string().optional(),
  error: z.string().optional(),
});
export type OidcCallbackQuery = z.infer<typeof oidcCallbackQuerySchema>;

export const oidcExchangeQuerySchema = z.object({
  code: z.string(),
});
export type OidcExchangeQuery = z.infer<typeof oidcExchangeQuerySchema>;