import type { AppRole } from '@/constants';

/**
 * The session identity the shells need for chrome. `roles` are the coarse actor roles
 * (customer/nurse/admin) derived from the server's fine-grained role codes via
 * `toAppRoles`; `id` is optional because verify_otp returns roles but not the id — `/me`
 * (via useSessionRoleSync) fills it once loaded.
 */
export interface SessionUser {
  id?: number;
  phone: string;
  roles: AppRole[];
  /**
   * The server's **fine-grained** role codes (e.g. `super_admin`/`support`/`finance`/`moderation`),
   * preserved alongside the collapsed `roles` so the f15 admin backoffice can gate individual consoles
   * via `useAdminCapabilities()`. Only hydrated from `/me` (useSessionRoleSync); the coarse `roles`
   * still drive shell chrome. Empty/undefined for a session that hasn't loaded `/me` yet.
   */
  roleCodes?: string[];
}

export interface AuthState {
  isAuthenticated: boolean;
  currentUser?: SessionUser;
}

export type AuthAction = { type: 'LOG_IN'; user?: SessionUser } | { type: 'LOG_OUT' };

export const INITIAL_AUTH_STATE: AuthState = {
  isAuthenticated: false,
};
