package model

// Reference: M13 §3 — SAML Identity Provider per-account configuration
// Enables multi-tenant identity isolation: each account (tenant) can configure
// its own SAML IdP, allowing enterprise customers to bring their own IdP
// (Okta, Azure AD, OneLogin, etc.) while maintaining complete identity isolation
// between tenants.
// This mirrors Chatwoot's account-scoped SAML configuration pattern.

import (
	"time"

	"gorm.io/gorm"
)

// SAMLIdPConfig stores per-account SAML IdP configuration for multi-tenant identity isolation.
// Each account can have exactly one active SAML IdP configuration.
type SAMLIdPConfig struct {
	ID                uint           `gorm:"primaryKey" json:"id"`
	AccountID         uint           `gorm:"not null;uniqueIndex" json:"account_id"` // one active config per account
	IdPEntityID       string         `gorm:"size:512;not null" json:"idp_entity_id"` // IdP entity ID (e.g. https://idp.example.com/metadata)
	IdPMetadataURL    string         `gorm:"size:1024" json:"idp_metadata_url,omitempty"`   // URL to fetch IdP metadata XML
	IdPMetadataXML    string         `gorm:"type:text" json:"idp_metadata_xml,omitempty"`   // raw IdP metadata XML (fallback if URL unavailable)
	SPEntityID        string         `gorm:"size:512;not null" json:"sp_entity_id"`         // SP entity ID for this account (overrides global default)
	ACSURL             string         `gorm:"size:1024;not null" json:"acs_url"`              // ACS URL for this account (overrides global default)
	AttributeMapping   string         `gorm:"type:text" json:"attribute_mapping,omitempty"`  // JSON: {"uid":"nameid","email":"email","firstName":"givenName","lastName":"surname"}
	ClockDriftTolerance int           `gorm:"default:300" json:"clock_drift_tolerance"`      // seconds of allowed clock skew
	Active             bool           `gorm:"not null;default:true" json:"active"`           // whether this config is active
	CreatedBy          uint           `gorm:"not null" json:"created_by"`                    // admin user who created this config
	CreatedAt          time.Time      `gorm:"autoCreateTime" json:"created_at"`
	UpdatedAt          time.Time      `gorm:"autoUpdateTime" json:"updated_at"`
	DeletedAt          gorm.DeletedAt `gorm:"index" json:"deleted_at,omitempty"`

	// Relations
	Account Account `gorm:"foreignKey:AccountID" json:"account,omitempty"`
}

func (SAMLIdPConfig) TableName() string { return "saml_idp_configs" }

// SAMLAttributeMapping defines how SAML assertion attributes map to gochat user fields.
type SAMLAttributeMapping struct {
	UID       string `json:"uid"`       // maps to user identifier (default: NameID)
	Email     string `json:"email"`     // maps to user email
	FirstName string `json:"firstName"` // maps to user first_name
	LastName  string `json:"lastName"`  // maps to user last_name
}