export interface SSOUserData {
  oktaSub: string; // Required - Okta subject identifier
  email: string; // Required - Primary identifier for user lookup
  employeeId?: string; // Optional - HR System Employee ID
  dealerCode?: string; // Optional - Dealer code from SSO (e.g., from Tanflow)
  employeeNumber?: string; // Optional - Employee number from SSO
  firstName?: string;
  lastName?: string;
  displayName?: string;
  department?: string;
  designation?: string;
  phone?: string;
  reportingManagerId?: string;
  manager?: string; // Optional - Manager name from Okta profile
  jobTitle?: string; // Detailed title from Okta profile.title
  postalAddress?: string;
  mobilePhone?: string;
  secondEmail?: string;
  adGroups?: string[];
  role?: 'USER' | 'MANAGEMENT' | 'ADMIN';
  isActive?: boolean;
}

export interface SSOConfig {
  jwtSecret: string;
  jwtExpiry: string;
  refreshTokenExpiry: string;
  sessionSecret: string;
  allowedOrigins: string[];
  oktaDomain: string;
  oktaClientId: string;
  oktaClientSecret: string;
  oktaApiToken?: string; // Optional - SSWS token for Okta Users API
  tanflowBaseUrl?: string; // Tanflow IAM base URL
  tanflowClientId?: string; // Tanflow client ID
  tanflowClientSecret?: string; // Tanflow client secret
}

export interface AuthTokens {
  accessToken: string;
  refreshToken: string;
}

export interface LoginResponse {
  user: {
    userId: string;
    employeeId?: string | null;
    email: string;
    firstName?: string | null;
    lastName?: string | null;
    displayName?: string | null;
    department?: string | null;
    designation?: string | null;
    jobTitle?: string | null;
    role: 'USER' | 'MANAGEMENT' | 'ADMIN';
  };
  accessToken: string;
  refreshToken: string;
  oktaRefreshToken?: string;
  oktaAccessToken?: string;
  oktaIdToken?: string; // ID token for Okta logout
}
