import client from "./client";

export interface SsoStatus {
  enabled: boolean;
  provider_name: string | null;
  configured: boolean;
  login_url: string | null;
}

export interface SsoConfig {
  id: string;
  is_enabled: boolean;
  provider_name: string | null;
  sp_entity_id: string | null;
  sp_acs_url: string | null;
  sp_slo_url: string | null;
  sp_certificate: string | null;
  idp_entity_id: string | null;
  idp_sso_url: string | null;
  idp_slo_url: string | null;
  idp_certificate: string | null;
  attr_email: string | null;
  attr_username: string | null;
  attr_role: string | null;
  default_role: string | null;
  auto_provision: boolean;
  created_at: string | null;
  updated_at: string | null;
}

export interface SsoConfigUpdate {
  is_enabled: boolean;
  provider_name?: string | null;
  sp_entity_id?: string | null;
  sp_acs_url?: string | null;
  sp_slo_url?: string | null;
  sp_certificate?: string | null;
  sp_private_key?: string | null;
  idp_entity_id?: string | null;
  idp_sso_url?: string | null;
  idp_slo_url?: string | null;
  idp_certificate?: string | null;
  attr_email?: string | null;
  attr_username?: string | null;
  attr_role?: string | null;
  default_role?: string | null;
  auto_provision?: boolean;
}

/** Public — used by LoginPage to decide which login to show. */
export async function getSsoStatus(): Promise<SsoStatus> {
  const { data } = await client.get<SsoStatus>("/sso/status");
  return data;
}

/** Admin-only — full config. Returns 404 if never configured. */
export async function getSsoConfig(): Promise<SsoConfig> {
  const { data } = await client.get<SsoConfig>("/sso/config");
  return data;
}

/** Admin-only — create or replace SSO config. */
export async function updateSsoConfig(payload: SsoConfigUpdate): Promise<SsoConfig> {
  const { data } = await client.put<SsoConfig>("/sso/config", payload);
  return data;
}
