// Generated by scripts/gen-api.py from spec/openapi.json — do not edit.

import Foundation

// MARK: - Types

/// Used by POST /auth/device/start.
public struct DeviceStartResponse: Codable, Sendable, Hashable {
    public var deviceCode: String
    public var userCode: String
    public var verificationUri: String
    public var verificationUriComplete: String
    public var expiresIn: Int
    public var interval: Int

    public init(deviceCode: String, userCode: String, verificationUri: String, verificationUriComplete: String, expiresIn: Int, interval: Int) {
        self.deviceCode = deviceCode
        self.userCode = userCode
        self.verificationUri = verificationUri
        self.verificationUriComplete = verificationUriComplete
        self.expiresIn = expiresIn
        self.interval = interval
    }

    enum CodingKeys: String, CodingKey {
        case deviceCode = "device_code"
        case userCode = "user_code"
        case verificationUri = "verification_uri"
        case verificationUriComplete = "verification_uri_complete"
        case expiresIn = "expires_in"
        case interval
    }
}

/// Used by POST /auth/device/poll.
public struct DevicePollBody: Codable, Sendable, Hashable {
    public var deviceCode: String

    public init(deviceCode: String) {
        self.deviceCode = deviceCode
    }

    enum CodingKeys: String, CodingKey {
        case deviceCode = "device_code"
    }
}

/// Used by POST /auth/device/poll.
public struct DevicePollResponse: Codable, Sendable, Hashable {
    public var approved: Bool

    public init(approved: Bool) {
        self.approved = approved
    }

    enum CodingKeys: String, CodingKey {
        case approved
    }
}

/// Used by POST /auth/device/complete.
public struct DeviceCompleteBody: Codable, Sendable, Hashable {
    public var deviceCode: String
    public var confirmationCode: String

    public init(deviceCode: String, confirmationCode: String) {
        self.deviceCode = deviceCode
        self.confirmationCode = confirmationCode
    }

    enum CodingKeys: String, CodingKey {
        case deviceCode = "device_code"
        case confirmationCode = "confirmation_code"
    }
}

/// Used by POST /auth/device/complete.
public struct AccountUser: Codable, Sendable, Hashable, Identifiable {
    public var id: String
    public var email: String
    public var createdAt: String

    public init(id: String, email: String, createdAt: String) {
        self.id = id
        self.email = email
        self.createdAt = createdAt
    }

    enum CodingKeys: String, CodingKey {
        case id
        case email
        case createdAt = "created_at"
    }
}

/// Used by POST /auth/device/complete.
public struct DeviceCompleteResponse: Codable, Sendable, Hashable {
    public var accessToken: String
    public var refreshToken: String
    public var user: AccountUser

    public init(accessToken: String, refreshToken: String, user: AccountUser) {
        self.accessToken = accessToken
        self.refreshToken = refreshToken
        self.user = user
    }

    enum CodingKeys: String, CodingKey {
        case accessToken = "access_token"
        case refreshToken = "refresh_token"
        case user
    }
}

/// Values this build does not know decode as `.unrecognized`.
public enum ApiKeyStatus: RawRepresentable, Codable, Sendable, Hashable {
    case active
    case revoked
    /// A value the server sent that this version of the package does not list.
    case unrecognized(String)

    /// Every value the spec listed when this file was generated.
    public static let known: [ApiKeyStatus] = [.active, .revoked]

    public init(rawValue: String) {
        switch rawValue {
        case "active": self = .active
        case "revoked": self = .revoked
        default: self = .unrecognized(rawValue)
        }
    }

    public var rawValue: String {
        switch self {
        case .active: return "active"
        case .revoked: return "revoked"
        case .unrecognized(let raw): return raw
        }
    }

    public init(from decoder: any Decoder) throws {
        self.init(rawValue: try decoder.singleValueContainer().decode(String.self))
    }

    public func encode(to encoder: any Encoder) throws {
        var container = encoder.singleValueContainer()
        try container.encode(rawValue)
    }
}

/// Shared by 2 operations.
public struct ApiKey: Codable, Sendable, Hashable, Identifiable {
    public var id: String
    public var name: String
    public var keyPrefix: String
    public var createdAt: String
    public var lastUsedAt: String?
    public var revokedAt: String?
    public var revokedReason: String?
    public var status: ApiKeyStatus

    public init(id: String, name: String, keyPrefix: String, createdAt: String, lastUsedAt: String? = nil, revokedAt: String? = nil, revokedReason: String? = nil, status: ApiKeyStatus) {
        self.id = id
        self.name = name
        self.keyPrefix = keyPrefix
        self.createdAt = createdAt
        self.lastUsedAt = lastUsedAt
        self.revokedAt = revokedAt
        self.revokedReason = revokedReason
        self.status = status
    }

    enum CodingKeys: String, CodingKey {
        case id
        case name
        case keyPrefix = "key_prefix"
        case createdAt = "created_at"
        case lastUsedAt = "last_used_at"
        case revokedAt = "revoked_at"
        case revokedReason = "revoked_reason"
        case status
    }

    /// Explicit so required-but-nullable fields encode as `null` rather than vanishing.
    public func encode(to encoder: any Encoder) throws {
        var container = encoder.container(keyedBy: CodingKeys.self)
        try container.encode(id, forKey: .id)
        try container.encode(name, forKey: .name)
        try container.encode(keyPrefix, forKey: .keyPrefix)
        try container.encode(createdAt, forKey: .createdAt)
        try container.encode(lastUsedAt, forKey: .lastUsedAt)
        try container.encode(revokedAt, forKey: .revokedAt)
        try container.encode(revokedReason, forKey: .revokedReason)
        try container.encode(status, forKey: .status)
    }
}

/// Used by GET /auth/api-keys.
public struct ListApiKeysResponse: Codable, Sendable, Hashable {
    public var apiKeys: [ApiKey]

    public init(apiKeys: [ApiKey]) {
        self.apiKeys = apiKeys
    }

    enum CodingKeys: String, CodingKey {
        case apiKeys = "api-keys"
    }
}

/// Used by POST /auth/api-keys.
public struct CreateApiKeyResponse: Codable, Sendable, Hashable {
    public var apiKey: ApiKey
    public var token: String

    public init(apiKey: ApiKey, token: String) {
        self.apiKey = apiKey
        self.token = token
    }

    enum CodingKeys: String, CodingKey {
        case apiKey = "api-key"
        case token
    }
}

/// Used by POST /auth/api-keys/{id}/revoke.
public struct RevokeApiKeyResponse: Codable, Sendable, Hashable {
    public var ok: Bool

    public init(ok: Bool) {
        self.ok = ok
    }

    enum CodingKeys: String, CodingKey {
        case ok
    }
}

// MARK: - Operations

extension IrdOperation {
    public static let auth_deviceStart = IrdOperation(method: .post, pathTemplate: "/auth/device/start", module: "auth", name: "deviceStart", security: .anonymous)
    public static let auth_devicePoll = IrdOperation(method: .post, pathTemplate: "/auth/device/poll", module: "auth", name: "devicePoll", security: .anonymous)
    public static let auth_deviceComplete = IrdOperation(method: .post, pathTemplate: "/auth/device/complete", module: "auth", name: "deviceComplete", security: .anonymous)
    public static let auth_listApiKeys = IrdOperation(method: .get, pathTemplate: "/auth/api-keys", module: "auth", name: "listApiKeys", security: .jwtOnly)
    public static let auth_createApiKey = IrdOperation(method: .post, pathTemplate: "/auth/api-keys", module: "auth", name: "createApiKey", security: .jwtOnly)
    public static let auth_revokeApiKey = IrdOperation(method: .post, pathTemplate: "/auth/api-keys/{id}/revoke", module: "auth", name: "revokeApiKey", security: .jwtOnly)

    static let authOperations: [IrdOperation] = [.auth_deviceStart, .auth_devicePoll, .auth_deviceComplete, .auth_listApiKeys, .auth_createApiKey, .auth_revokeApiKey]
}

/// The `auth` operations (6).
public struct AuthAPI: Sendable {
    let client: IrdClient

    /// Start a device login
    /// Opens a device-authorization flow (`ird login`).
    /// `POST /auth/device/start` — 200
    /// Anonymous allowed.
    public func deviceStart() async throws -> DeviceStartResponse {
        try await client.request(.auth_deviceStart)
    }

    /// Poll a device login
    /// Reports the flow state for `device_code`.
    /// `POST /auth/device/poll` — 200
    /// Anonymous allowed.
    public func devicePoll(body: DevicePollBody) async throws -> DevicePollResponse {
        try await client.request(.auth_devicePoll, body: body)
    }

    /// Complete a device login
    /// Exchanges `device_code` plus the confirmation code shown in the user's browser for an access/refresh token pair. Single-use: a second call answers `401`. Five wrong confirmation codes destroy the flow.
    /// `POST /auth/device/complete` — 200
    /// Anonymous allowed.
    public func deviceComplete(body: DeviceCompleteBody) async throws -> DeviceCompleteResponse {
        try await client.request(.auth_deviceComplete, body: body)
    }

    /// List API keys
    /// Full key history for the authenticated account, newest first. Key material is never returned — only the display prefix.
    /// `GET /auth/api-keys` — 200
    /// Requires an account session (JWT); API keys answer 401.
    public func listApiKeys() async throws -> ListApiKeysResponse {
        try await client.request(.auth_listApiKeys)
    }

    /// Create an API key
    /// Creates a key and returns the full token **once** — it is stored only as a hash and cannot be retrieved again. At most 20 active keys per account.
    /// `POST /auth/api-keys` — 201
    /// Requires an account session (JWT); API keys answer 401.
    public func createApiKey(body: NameBody) async throws -> CreateApiKeyResponse {
        try await client.request(.auth_createApiKey, body: body)
    }

    /// Revoke an API key
    /// Revocation is immediate: requests using the key fail with `401` from the next call. Revoked keys stay in the list as history.
    /// `POST /auth/api-keys/{id}/revoke` — 200
    /// Requires an account session (JWT); API keys answer 401.
    public func revokeApiKey(id: String) async throws -> RevokeApiKeyResponse {
        try await client.request(.auth_revokeApiKey, params: ["id": id])
    }
}

extension IrdClient {
    public var auth: AuthAPI { AuthAPI(client: self) }
}