import {z} from 'zod'

export type GetApiPoliciesEventMatcherPolicyUuidArgs = {policy_uuid: string};

export type GetApiPoliciesEventMatcherPolicyUuidOptions = {baseUrl: string, authentik?: string | undefined, fetch?: typeof fetch | undefined};

export const eventActions = z.enum(["login", "login_failed", "logout", "user_write", "user_offboarded", "suspicious_request", "password_set", "authenticator_locked", "authenticator_unlocked", "required_action_completed", "secret_view", "secret_rotate", "invitation_used", "authorize_application", "source_linked", "impersonation_started", "impersonation_ended", "flow_execution", "policy_execution", "policy_exception", "property_mapping_exception", "system_task_execution", "system_task_exception", "system_exception", "configuration_error", "configuration_warning", "model_created", "model_updated", "model_deleted", "email_sent", "update_available", "export_ready", "review_initiated", "review_overdue", "review_attested", "review_completed", "access_request_created", "access_request_approved", "access_request_denied", "access_request_revoked", "custom_"]);

export const appEnum = z.enum(["authentik.commands", "authentik.tasks", "authentik.admin", "authentik.api", "authentik.core", "authentik.crypto", "authentik.endpoints", "authentik.endpoints.connectors.agent", "authentik.enterprise", "authentik.events", "authentik.admin.files", "authentik.flows", "authentik.outposts", "authentik.policies.dummy", "authentik.policies.event_matcher", "authentik.policies.expiry", "authentik.policies.expression", "authentik.policies.geoip", "authentik.policies.password", "authentik.policies.reputation", "authentik.policies", "authentik.providers.ldap", "authentik.providers.oauth2", "authentik.providers.proxy", "authentik.providers.rac", "authentik.providers.radius", "authentik.providers.saml", "authentik.providers.scim", "authentik.rbac", "authentik.recovery", "authentik.sources.kerberos", "authentik.sources.ldap", "authentik.sources.oauth", "authentik.sources.plex", "authentik.sources.saml", "authentik.sources.scim", "authentik.sources.telegram", "authentik.stages.authenticator", "authentik.stages.authenticator_duo", "authentik.stages.authenticator_email", "authentik.stages.authenticator_sms", "authentik.stages.authenticator_static", "authentik.stages.authenticator_totp", "authentik.stages.authenticator_validate", "authentik.stages.authenticator_webauthn", "authentik.stages.captcha", "authentik.stages.consent", "authentik.stages.deny", "authentik.stages.dummy", "authentik.stages.email", "authentik.stages.identification", "authentik.stages.invitation", "authentik.stages.password", "authentik.stages.prompt", "authentik.stages.redirect", "authentik.stages.user_delete", "authentik.stages.user_login", "authentik.stages.user_logout", "authentik.stages.user_write", "authentik.tasks.schedules", "authentik.tenants", "authentik.brands", "authentik.blueprints", "authentik.enterprise.agents", "authentik.enterprise.audit", "authentik.enterprise.endpoints.connectors.agent", "authentik.enterprise.endpoints.connectors.fleet", "authentik.enterprise.endpoints.connectors.google_chrome", "authentik.enterprise.endpoints.connectors.microsoft_intune", "authentik.enterprise.lifecycle", "authentik.enterprise.policies.unique_password", "authentik.enterprise.providers.google_workspace", "authentik.enterprise.providers.microsoft_entra", "authentik.enterprise.providers.radius", "authentik.enterprise.providers.scim", "authentik.enterprise.providers.ssf", "authentik.enterprise.providers.ws_federation", "authentik.enterprise.reports", "authentik.enterprise.requests", "authentik.enterprise.stages.account_lockdown", "authentik.enterprise.stages.authenticator_endpoint_gdtc", "authentik.enterprise.stages.mtls", "authentik.enterprise.stages.source"]);

export const modelEnum = z.enum(["authentik_core.group", "authentik_core.user", "authentik_core.application", "authentik_core.applicationentitlement", "authentik_core.token", "authentik_core.objectattribute", "authentik_core.actor", "authentik_crypto.certificatekeypair", "authentik_endpoints.deviceuserbinding", "authentik_endpoints.deviceaccessgroup", "authentik_endpoints.endpointstage", "authentik_endpoints_connectors_agent.agentconnector", "authentik_endpoints_connectors_agent.agentdeviceuserbinding", "authentik_endpoints_connectors_agent.enrollmenttoken", "authentik_enterprise.license", "authentik_events.event", "authentik_events.notificationtransport", "authentik_events.notification", "authentik_events.notificationrule", "authentik_events.notificationwebhookmapping", "authentik_flows.flow", "authentik_flows.flowstagebinding", "authentik_outposts.dockerserviceconnection", "authentik_outposts.kubernetesserviceconnection", "authentik_outposts.outpost", "authentik_policies_dummy.dummypolicy", "authentik_policies_event_matcher.eventmatcherpolicy", "authentik_policies_expiry.passwordexpirypolicy", "authentik_policies_expression.expressionpolicy", "authentik_policies_geoip.geoippolicy", "authentik_policies_password.passwordpolicy", "authentik_policies_reputation.reputationpolicy", "authentik_policies.policybinding", "authentik_providers_ldap.ldapprovider", "authentik_providers_oauth2.scopemapping", "authentik_providers_oauth2.oauth2provider", "authentik_providers_oauth2.oauth2dynamicclientregistration", "authentik_providers_proxy.proxyprovider", "authentik_providers_rac.racprovider", "authentik_providers_rac.racpropertymapping", "authentik_providers_radius.radiusprovider", "authentik_providers_radius.radiusproviderpropertymapping", "authentik_providers_saml.samlprovider", "authentik_providers_saml.samlpropertymapping", "authentik_providers_scim.scimprovider", "authentik_providers_scim.scimmapping", "authentik_rbac.role", "authentik_rbac.initialpermissions", "authentik_rbac.custompermission", "authentik_rbac.permissioncheck", "authentik_sources_kerberos.kerberossource", "authentik_sources_kerberos.kerberossourcepropertymapping", "authentik_sources_kerberos.userkerberossourceconnection", "authentik_sources_kerberos.groupkerberossourceconnection", "authentik_sources_ldap.ldapsource", "authentik_sources_ldap.ldapsourcepropertymapping", "authentik_sources_ldap.userldapsourceconnection", "authentik_sources_ldap.groupldapsourceconnection", "authentik_sources_oauth.oauthsource", "authentik_sources_oauth.oauthsourcepropertymapping", "authentik_sources_oauth.useroauthsourceconnection", "authentik_sources_oauth.groupoauthsourceconnection", "authentik_sources_plex.plexsource", "authentik_sources_plex.plexsourcepropertymapping", "authentik_sources_plex.userplexsourceconnection", "authentik_sources_plex.groupplexsourceconnection", "authentik_sources_saml.samlsource", "authentik_sources_saml.samlsourcepropertymapping", "authentik_sources_saml.usersamlsourceconnection", "authentik_sources_saml.groupsamlsourceconnection", "authentik_sources_scim.scimsource", "authentik_sources_scim.scimsourcepropertymapping", "authentik_sources_telegram.telegramsource", "authentik_sources_telegram.telegramsourcepropertymapping", "authentik_sources_telegram.usertelegramsourceconnection", "authentik_sources_telegram.grouptelegramsourceconnection", "authentik_stages_authenticator_duo.authenticatorduostage", "authentik_stages_authenticator_duo.duodevice", "authentik_stages_authenticator_email.authenticatoremailstage", "authentik_stages_authenticator_email.emaildevice", "authentik_stages_authenticator_sms.authenticatorsmsstage", "authentik_stages_authenticator_sms.smsdevice", "authentik_stages_authenticator_static.authenticatorstaticstage", "authentik_stages_authenticator_static.staticdevice", "authentik_stages_authenticator_totp.authenticatortotpstage", "authentik_stages_authenticator_totp.totpdevice", "authentik_stages_authenticator_validate.authenticatorvalidatestage", "authentik_stages_authenticator_webauthn.authenticatorwebauthnstage", "authentik_stages_authenticator_webauthn.webauthndevice", "authentik_stages_captcha.captchastage", "authentik_stages_consent.consentstage", "authentik_stages_deny.denystage", "authentik_stages_dummy.dummystage", "authentik_stages_email.emailstage", "authentik_stages_identification.identificationstage", "authentik_stages_invitation.invitationstage", "authentik_stages_invitation.invitation", "authentik_stages_password.passwordstage", "authentik_stages_prompt.prompt", "authentik_stages_prompt.promptstage", "authentik_stages_redirect.redirectstage", "authentik_stages_user_delete.userdeletestage", "authentik_stages_user_login.userloginstage", "authentik_stages_user_logout.userlogoutstage", "authentik_stages_user_write.userwritestage", "authentik_tasks_schedules.schedule", "authentik_brands.brand", "authentik_blueprints.blueprintinstance", "authentik_agents.agent", "authentik_endpoints_connectors_fleet.fleetconnector", "authentik_endpoints_connectors_google_chrome.googlechromeconnector", "authentik_endpoints_connectors_microsoft_intune.microsoftintuneconnector", "authentik_lifecycle.lifecyclerule", "authentik_lifecycle.lifecycleiteration", "authentik_lifecycle.review", "authentik_lifecycle.useroffboarding", "authentik_policies_unique_password.uniquepasswordpolicy", "authentik_providers_google_workspace.googleworkspaceprovider", "authentik_providers_google_workspace.googleworkspaceprovidermapping", "authentik_providers_microsoft_entra.microsoftentraprovider", "authentik_providers_microsoft_entra.microsoftentraprovidermapping", "authentik_providers_ssf.ssfprovider", "authentik_providers_ws_federation.wsfederationprovider", "authentik_reports.dataexport", "authentik_requests.requestrulechildbinding", "authentik_requests.requestrulebinding", "authentik_requests.requestrule", "authentik_requests.grantrequest", "authentik_stages_account_lockdown.accountlockdownstage", "authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage", "authentik_stages_mtls.mutualtlsstage", "authentik_stages_source.sourcestage"]);

export const eventMatcherPolicy = z.object({pk: z.string(), name: z.string(), execution_logging: z.boolean().optional(), component: z.string(), verbose_name: z.string(), verbose_name_plural: z.string(), meta_model_name: z.string(), bound_to: z.number().int(), last_updated: z.string(), created: z.string(), action: eventActions.nullable().optional(), client_ip: z.string().nullable().optional(), app: appEnum.nullable().optional(), model: modelEnum.nullable().optional(), query: z.string().nullable().optional()});

export const validateResponse = async <Output>(
  schema: {
    readonly '~standard': {
      readonly validate: (value: unknown) => ({ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }) | Promise<{ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }>
    }
  },
  value: unknown
): Promise<Output> => {
  const result = await schema['~standard'].validate(value)

  if (result.issues !== undefined) {
    const detail = result.issues
      .map(({ message, path }) =>
        path?.length
          ? `${path.map((segment) => String(typeof segment === 'object' ? segment.key : segment)).join('.')}: ${message}`
          : message
      )
      .join('; ')

    throw new Error(`Response does not match the schema: ${detail}`, { cause: { issues: result.issues } })
  }

  return result.value
};

/**
 * Event Matcher Policy Viewset
 * 
 * GET /policies/event_matcher/{policy_uuid}/
 */
export const getApiPoliciesEventMatcherPolicyUuid = async (args: GetApiPoliciesEventMatcherPolicyUuidArgs, options: GetApiPoliciesEventMatcherPolicyUuidOptions) => {
const {baseUrl, fetch: fetchFn = fetch, authentik} = options ?? {}

const query = new URLSearchParams()
const headers = new Headers()
headers.set('accept', "application/json")

if (authentik !== undefined) headers.set('authorization', `Bearer ${authentik}`)

const url = `${baseUrl.replace(/\/+$/, '')}/policies/event_matcher/${encodeURIComponent(String(args.policy_uuid))}/${query.size > 0 ? `?${query}` : ''}`

const res = await fetchFn(url, {method: "GET", headers})

if (!res.ok) throw new Error(`Request failed with status ${res.status}`, {cause: {status: res.status, body: await res.text()}})

return validateResponse(eventMatcherPolicy, await res.json())
};