cmd

type Auth0User struct {
	UserID        string `json:"user_id"`
	Email         string `json:"email"`
	EmailVerified bool   `json:"email_verified"`
	Name          string `json:"name"`
	Nickname      string `json:"nickname"`
}

type CredEnvelopeRaw struct {
	KekID         string `json:"kek_id"`
	Alg           string `json:"alg"`
	Nonce         string `json:"nonce"`
	Tag           string `json:"tag"`
	Ciphertext    string `json:"ciphertext"`
	DekNonce      string `json:"dek_nonce"`
	DekTag        string `json:"dek_tag"`
	DekCiphertext string `json:"dek_ciphertext"`
}

type Cursor struct {
	Provider      string        `json:"provider"`
	File          string        `json:"file"`
	FileSize      int64         `json:"file_size"`
	LastIndex     int           `json:"last_index"`
	Completed     bool          `json:"completed"`
	StartedAt     time.Time     `json:"started_at"`
	LastUpdatedAt time.Time     `json:"last_updated_at"`
	Summary       CursorSummary `json:"summary"`
}

type CursorSummary struct {
	Created int `json:"created"`
	Existed int `json:"existed"`
	Skipped int `json:"skipped"`
	Errored int `json:"errored"`
}

type IdentityRecord struct {
	UserExternalID string         `json:"user_external_id"`
	Kind           string         `json:"kind"`
	Subject        string         `json:"subject"`
	Metadata       map[string]any `json:"metadata,omitempty"`
}

type ImportPlan struct {
	Provider        string                `json:"provider"`
	Users           []UserRecord          `json:"users"`
	Orgs            []OrgRecord           `json:"orgs"`
	Memberships     []MembershipRecord    `json:"memberships"`
	Identities      []IdentityRecord      `json:"identities"`
	SsoConnections  []SsoConnectionRecord `json:"sso_connections"`
	ScimDirectories []ScimDirectoryRecord `json:"scim_directories"`
	Warnings        []string              `json:"warnings"`
	Stats           PlanStats             `json:"stats"`
}

type ImportRunner struct {
	Parser    Parser
	File      string
	APIKey    string
	APIURL    string
	DryRun    bool
	Force     bool
	RateLimit int          // requests per second; defaults to 50
	HTTP      *http.Client // injectable for tests
	Out       io.Writer    // pretty-prints progress; defaults to os.Stdout
	NowFunc   func() time.Time
	SleepFunc func(time.Duration)
	UserAgent string
}

type LiveCredentials struct {
	// Auth0
	Domain string `json:"domain,omitempty"`
	Token  string `json:"token,omitempty"`

	// Clerk
	SecretKey string `json:"secret_key,omitempty"`

	// WorkOS
	APIKey string `json:"api_key,omitempty"`

	// Stytch (also reused by Descope for ProjectID)
	ProjectID     string `json:"project_id,omitempty"`
	ProjectSecret string `json:"project_secret,omitempty"`

	// Descope
	MgmtKey string `json:"mgmt_key,omitempty"`

	// Cognito
	AccessKeyID     string `json:"access_key_id,omitempty"`
	SecretAccessKey string `json:"secret_access_key,omitempty"`
	Region          string `json:"region,omitempty"`
	UserPoolID      string `json:"user_pool_id,omitempty"`

	// Firebase
	ServiceAccountJSON string `json:"service_account_json,omitempty"`

	// Supabase
	PAT        string `json:"pat,omitempty"`
	ProjectRef string `json:"project_ref,omitempty"`
}

type LiveOptions struct {
	// BaseURLOverride lets tests redirect provider API calls at a
	// localhost httptest.Server. Empty means use the real provider host.
	BaseURLOverride string
	// MaxPages caps pagination so a runaway export doesn't dominate a
	// dev machine. 0 = unbounded.
	MaxPages int
	// RateLimitPerSec caps requests/sec. 0 falls back to providerDefault.
	RateLimitPerSec float64
	// HTTPClient lets the caller inject a custom transport (used by the
	// migrate-run command for retries + telemetry).
	HTTPClient *http.Client
	// ProgressFn, if set, is called every batch with (kind, count). It
	// powers the import_jobs.progress JSONB updates.
	ProgressFn func(kind string, completed int)
	// TargetOrganizationID pins memberships to an existing Authio org.
	TargetOrganizationID string
	// SourceWorkOSOrganizationID filters WorkOS live pulls to one org.
	SourceWorkOSOrganizationID string
}

type LivePuller interface {
	Name() string
	PullLive(ctx context.Context, creds LiveCredentials, opts LiveOptions) (*ImportPlan, error)
}

type MembershipRecord struct {
	UserExternalID string `json:"user_external_id"`
	OrgExternalID  string `json:"org_external_id"`
	Role           string `json:"role"`
	Status         string `json:"status"`
}

type OrgRecord struct {
	ExternalID string `json:"external_id"`
	Name       string `json:"name"`
	Slug       string `json:"slug"`
	Domain     string `json:"domain,omitempty"`
}

type Parser interface {
	// Name is the provider key used in cursor + UA.
	Name() string
	// Help returns a short string describing the expected file format.
	// Surfaced via `authio import <provider> --help`.
	Help() string
	// Parse reads from r and calls emit for every record. Records that
	// should be skipped (disabled, banned, missing email, etc.) are
	// emitted with Email == "" so the runner can count them as skipped
	// without breaking the cursor's count-of-records-seen invariant.
	Parse(ctx context.Context, r io.Reader, emit func(SourceUser) error) error
}

type PlanOptions struct {
	// OrgsTablePath, when non-empty, is a path to a JSON file describing
	// an org graph for providers (Supabase, Firebase) that don't have a
	// first-class org concept. Format:
	//
	//   {
	//     "orgs":[{"external_id":"...", "name":"...", "slug":"...",
	//              "domain":"...", "members":[{"email":"...","role":"admin"}]}]
	//   }
	OrgsTablePath string
	// MergeDuplicateEmails enables WorkOS-style merge: source users with
	// the same email across multiple source orgs collapse into one Authio
	// user with N memberships. Default true.
	MergeDuplicateEmails bool
	// DefaultOrgName is used when a provider has zero orgs in its export
	// (Supabase without --orgs-table, Firebase, Consumer Stytch). All
	// users land under this org as members.
	DefaultOrgName string
	// TargetOrganizationID pins every imported membership (and SSO/SCIM)
	// to this existing Authio org. WorkOS org rows are not created.
	TargetOrganizationID string
	// SourceWorkOSOrganizationID limits the import to one WorkOS org's
	// users/memberships when set (optional).
	SourceWorkOSOrganizationID string
}

type PlanParser interface {
	Name() string
	Help() string
	ParsePlan(ctx context.Context, r io.Reader, opts PlanOptions) (*ImportPlan, error)
}

type PlanRunner struct {
	APIURL   string
	APIKey   string
	HTTP     *http.Client
	Out      io.Writer // progress sink; defaults to os.Stdout
	EmitJSON bool      // emit NDJSON events instead of human lines
	DryRun   bool
	// ExtraHeaders are merged into every outbound request. Used by the
	// migrate worker to send X-Authio-Worker + X-Authio-Project-Id so
	// the management-api accepts the call without a real API key.
	ExtraHeaders map[string]string
	// TargetOrganizationID pins memberships to an existing Authio org.
	TargetOrganizationID string
	// RecordErrors collects per-record failures for the dashboard.
	RecordErrors []RecordError
}

type PlanStats struct {
	SourceUsers            int `json:"source_users"`
	MergedUsers            int `json:"merged_users"`
	UsersCreated           int `json:"users_created"`
	UsersExisted           int `json:"users_existed"`
	OrgsCreated            int `json:"orgs_created"`
	OrgsExisted            int `json:"orgs_existed"`
	MembershipsCreated     int `json:"memberships_created"`
	IdentitiesCreated      int `json:"identities_created"`
	SsoConnectionsCreated  int `json:"sso_connections_created"`
	ScimDirectoriesCreated int `json:"scim_directories_created"`
	Errored                int `json:"errored"`
	Warnings               int `json:"warnings"`
}

type RecordError struct {
	Kind string `json:"kind"`
	Key  string `json:"key"`
	Msg  string `json:"msg"`
}

type ScimDirectoryRecord struct {
	OrgExternalID string `json:"org_external_id"`
	Name          string `json:"name"`
}

type SourceUser struct {
	Email          string
	Name           string
	EmailVerified  bool
	SourceID       string
	SourceProvider string
	Metadata       map[string]any
}

type SsoConnectionRecord struct {
	OrgExternalID string         `json:"org_external_id"`
	Name          string         `json:"name"`
	Kind          string         `json:"kind"`
	Metadata      map[string]any `json:"metadata,omitempty"`
}

type UserRecord struct {
	ExternalID            string         `json:"external_id"`
	Email                 string         `json:"email"`
	EmailVerified         bool           `json:"email_verified"`
	Name                  string         `json:"name,omitempty"`
	AvatarURL             string         `json:"avatar_url,omitempty"`
	Metadata              map[string]any `json:"metadata,omitempty"`
	MigrationPendingEmail bool           `json:"migration_pending_email"`
	MfaEnrolled           bool           `json:"mfa_enrolled,omitempty"`
	// SourceExternalIDs is the list of every source-system ID that
	// merged into this Authio user. For most providers it is a 1-element
	// list. WorkOS produces N-element lists when the same email appears
	// in multiple WorkOS orgs (the "marquee" merge moment).
	SourceExternalIDs []string `json:"source_external_ids,omitempty"`
}