import {z} from 'zod'

export type EventActions = 'login' | 'login_failed' | 'logout' | 'user_write' | 'user_offboarded' | 'suspicious_request' | 'password_set' | 'authenticator_locked' | 'authenticator_unlocked' | 'required_action_completed' | 'secret_view' | 'secret_rotate' | 'invitation_used' | 'authorize_application' | 'source_linked' | 'impersonation_started' | 'impersonation_ended' | 'flow_execution' | 'policy_execution' | 'policy_exception' | 'property_mapping_exception' | 'system_task_execution' | 'system_task_exception' | 'system_exception' | 'configuration_error' | 'configuration_warning' | 'model_created' | 'model_updated' | 'model_deleted' | 'email_sent' | 'update_available' | 'export_ready' | 'review_initiated' | 'review_overdue' | 'review_attested' | 'review_completed' | 'access_request_created' | 'access_request_approved' | 'access_request_denied' | 'access_request_revoked' | 'custom_';

export type AppEnum = 'authentik.commands' | 'authentik.tasks' | 'authentik.admin' | 'authentik.api' | 'authentik.core' | 'authentik.crypto' | 'authentik.endpoints' | 'authentik.endpoints.connectors.agent' | 'authentik.enterprise' | 'authentik.events' | 'authentik.admin.files' | 'authentik.flows' | 'authentik.outposts' | 'authentik.policies.dummy' | 'authentik.policies.event_matcher' | 'authentik.policies.expiry' | 'authentik.policies.expression' | 'authentik.policies.geoip' | 'authentik.policies.password' | 'authentik.policies.reputation' | 'authentik.policies' | 'authentik.providers.ldap' | 'authentik.providers.oauth2' | 'authentik.providers.proxy' | 'authentik.providers.rac' | 'authentik.providers.radius' | 'authentik.providers.saml' | 'authentik.providers.scim' | 'authentik.rbac' | 'authentik.recovery' | 'authentik.sources.kerberos' | 'authentik.sources.ldap' | 'authentik.sources.oauth' | 'authentik.sources.plex' | 'authentik.sources.saml' | 'authentik.sources.scim' | 'authentik.sources.telegram' | 'authentik.stages.authenticator' | 'authentik.stages.authenticator_duo' | 'authentik.stages.authenticator_email' | 'authentik.stages.authenticator_sms' | 'authentik.stages.authenticator_static' | 'authentik.stages.authenticator_totp' | 'authentik.stages.authenticator_validate' | 'authentik.stages.authenticator_webauthn' | 'authentik.stages.captcha' | 'authentik.stages.consent' | 'authentik.stages.deny' | 'authentik.stages.dummy' | 'authentik.stages.email' | 'authentik.stages.identification' | 'authentik.stages.invitation' | 'authentik.stages.password' | 'authentik.stages.prompt' | 'authentik.stages.redirect' | 'authentik.stages.user_delete' | 'authentik.stages.user_login' | 'authentik.stages.user_logout' | 'authentik.stages.user_write' | 'authentik.tasks.schedules' | 'authentik.tenants' | 'authentik.brands' | 'authentik.blueprints' | 'authentik.enterprise.agents' | 'authentik.enterprise.audit' | 'authentik.enterprise.endpoints.connectors.agent' | 'authentik.enterprise.endpoints.connectors.fleet' | 'authentik.enterprise.endpoints.connectors.google_chrome' | 'authentik.enterprise.endpoints.connectors.microsoft_intune' | 'authentik.enterprise.lifecycle' | 'authentik.enterprise.policies.unique_password' | 'authentik.enterprise.providers.google_workspace' | 'authentik.enterprise.providers.microsoft_entra' | 'authentik.enterprise.providers.radius' | 'authentik.enterprise.providers.scim' | 'authentik.enterprise.providers.ssf' | 'authentik.enterprise.providers.ws_federation' | 'authentik.enterprise.reports' | 'authentik.enterprise.requests' | 'authentik.enterprise.stages.account_lockdown' | 'authentik.enterprise.stages.authenticator_endpoint_gdtc' | 'authentik.enterprise.stages.mtls' | 'authentik.enterprise.stages.source';

export type ModelEnum = 'authentik_core.group' | 'authentik_core.user' | 'authentik_core.application' | 'authentik_core.applicationentitlement' | 'authentik_core.token' | 'authentik_core.objectattribute' | 'authentik_core.actor' | 'authentik_crypto.certificatekeypair' | 'authentik_endpoints.deviceuserbinding' | 'authentik_endpoints.deviceaccessgroup' | 'authentik_endpoints.endpointstage' | 'authentik_endpoints_connectors_agent.agentconnector' | 'authentik_endpoints_connectors_agent.agentdeviceuserbinding' | 'authentik_endpoints_connectors_agent.enrollmenttoken' | 'authentik_enterprise.license' | 'authentik_events.event' | 'authentik_events.notificationtransport' | 'authentik_events.notification' | 'authentik_events.notificationrule' | 'authentik_events.notificationwebhookmapping' | 'authentik_flows.flow' | 'authentik_flows.flowstagebinding' | 'authentik_outposts.dockerserviceconnection' | 'authentik_outposts.kubernetesserviceconnection' | 'authentik_outposts.outpost' | 'authentik_policies_dummy.dummypolicy' | 'authentik_policies_event_matcher.eventmatcherpolicy' | 'authentik_policies_expiry.passwordexpirypolicy' | 'authentik_policies_expression.expressionpolicy' | 'authentik_policies_geoip.geoippolicy' | 'authentik_policies_password.passwordpolicy' | 'authentik_policies_reputation.reputationpolicy' | 'authentik_policies.policybinding' | 'authentik_providers_ldap.ldapprovider' | 'authentik_providers_oauth2.scopemapping' | 'authentik_providers_oauth2.oauth2provider' | 'authentik_providers_oauth2.oauth2dynamicclientregistration' | 'authentik_providers_proxy.proxyprovider' | 'authentik_providers_rac.racprovider' | 'authentik_providers_rac.racpropertymapping' | 'authentik_providers_radius.radiusprovider' | 'authentik_providers_radius.radiusproviderpropertymapping' | 'authentik_providers_saml.samlprovider' | 'authentik_providers_saml.samlpropertymapping' | 'authentik_providers_scim.scimprovider' | 'authentik_providers_scim.scimmapping' | 'authentik_rbac.role' | 'authentik_rbac.initialpermissions' | 'authentik_rbac.custompermission' | 'authentik_rbac.permissioncheck' | 'authentik_sources_kerberos.kerberossource' | 'authentik_sources_kerberos.kerberossourcepropertymapping' | 'authentik_sources_kerberos.userkerberossourceconnection' | 'authentik_sources_kerberos.groupkerberossourceconnection' | 'authentik_sources_ldap.ldapsource' | 'authentik_sources_ldap.ldapsourcepropertymapping' | 'authentik_sources_ldap.userldapsourceconnection' | 'authentik_sources_ldap.groupldapsourceconnection' | 'authentik_sources_oauth.oauthsource' | 'authentik_sources_oauth.oauthsourcepropertymapping' | 'authentik_sources_oauth.useroauthsourceconnection' | 'authentik_sources_oauth.groupoauthsourceconnection' | 'authentik_sources_plex.plexsource' | 'authentik_sources_plex.plexsourcepropertymapping' | 'authentik_sources_plex.userplexsourceconnection' | 'authentik_sources_plex.groupplexsourceconnection' | 'authentik_sources_saml.samlsource' | 'authentik_sources_saml.samlsourcepropertymapping' | 'authentik_sources_saml.usersamlsourceconnection' | 'authentik_sources_saml.groupsamlsourceconnection' | 'authentik_sources_scim.scimsource' | 'authentik_sources_scim.scimsourcepropertymapping' | 'authentik_sources_telegram.telegramsource' | 'authentik_sources_telegram.telegramsourcepropertymapping' | 'authentik_sources_telegram.usertelegramsourceconnection' | 'authentik_sources_telegram.grouptelegramsourceconnection' | 'authentik_stages_authenticator_duo.authenticatorduostage' | 'authentik_stages_authenticator_duo.duodevice' | 'authentik_stages_authenticator_email.authenticatoremailstage' | 'authentik_stages_authenticator_email.emaildevice' | 'authentik_stages_authenticator_sms.authenticatorsmsstage' | 'authentik_stages_authenticator_sms.smsdevice' | 'authentik_stages_authenticator_static.authenticatorstaticstage' | 'authentik_stages_authenticator_static.staticdevice' | 'authentik_stages_authenticator_totp.authenticatortotpstage' | 'authentik_stages_authenticator_totp.totpdevice' | 'authentik_stages_authenticator_validate.authenticatorvalidatestage' | 'authentik_stages_authenticator_webauthn.authenticatorwebauthnstage' | 'authentik_stages_authenticator_webauthn.webauthndevice' | 'authentik_stages_captcha.captchastage' | 'authentik_stages_consent.consentstage' | 'authentik_stages_deny.denystage' | 'authentik_stages_dummy.dummystage' | 'authentik_stages_email.emailstage' | 'authentik_stages_identification.identificationstage' | 'authentik_stages_invitation.invitationstage' | 'authentik_stages_invitation.invitation' | 'authentik_stages_password.passwordstage' | 'authentik_stages_prompt.prompt' | 'authentik_stages_prompt.promptstage' | 'authentik_stages_redirect.redirectstage' | 'authentik_stages_user_delete.userdeletestage' | 'authentik_stages_user_login.userloginstage' | 'authentik_stages_user_logout.userlogoutstage' | 'authentik_stages_user_write.userwritestage' | 'authentik_tasks_schedules.schedule' | 'authentik_brands.brand' | 'authentik_blueprints.blueprintinstance' | 'authentik_agents.agent' | 'authentik_endpoints_connectors_fleet.fleetconnector' | 'authentik_endpoints_connectors_google_chrome.googlechromeconnector' | 'authentik_endpoints_connectors_microsoft_intune.microsoftintuneconnector' | 'authentik_lifecycle.lifecyclerule' | 'authentik_lifecycle.lifecycleiteration' | 'authentik_lifecycle.review' | 'authentik_lifecycle.useroffboarding' | 'authentik_policies_unique_password.uniquepasswordpolicy' | 'authentik_providers_google_workspace.googleworkspaceprovider' | 'authentik_providers_google_workspace.googleworkspaceprovidermapping' | 'authentik_providers_microsoft_entra.microsoftentraprovider' | 'authentik_providers_microsoft_entra.microsoftentraprovidermapping' | 'authentik_providers_ssf.ssfprovider' | 'authentik_providers_ws_federation.wsfederationprovider' | 'authentik_reports.dataexport' | 'authentik_requests.requestrulechildbinding' | 'authentik_requests.requestrulebinding' | 'authentik_requests.requestrule' | 'authentik_requests.grantrequest' | 'authentik_stages_account_lockdown.accountlockdownstage' | 'authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage' | 'authentik_stages_mtls.mutualtlsstage' | 'authentik_stages_source.sourcestage';

export type EventMatcherPolicyRequest = {name: string, execution_logging?: boolean | undefined, action?: (EventActions | null) | undefined, client_ip?: (string | null) | undefined, app?: (AppEnum | null) | undefined, model?: (ModelEnum | null) | undefined, query?: (string | null) | undefined};

export type UpdateApiPoliciesEventMatcherPolicyUuidArgs = {policy_uuid: string, body: EventMatcherPolicyRequest};

export type UpdateApiPoliciesEventMatcherPolicyUuidOptions = {baseUrl: string, authentik?: string | undefined, fetch?: typeof fetch | undefined};

export const eventActions = z.enum(["login", "login_failed", "logout", "user_write", "user_offboarded", "suspicious_request", "password_set", "authenticator_locked", "authenticator_unlocked", "required_action_completed", "secret_view", "secret_rotate", "invitation_used", "authorize_application", "source_linked", "impersonation_started", "impersonation_ended", "flow_execution", "policy_execution", "policy_exception", "property_mapping_exception", "system_task_execution", "system_task_exception", "system_exception", "configuration_error", "configuration_warning", "model_created", "model_updated", "model_deleted", "email_sent", "update_available", "export_ready", "review_initiated", "review_overdue", "review_attested", "review_completed", "access_request_created", "access_request_approved", "access_request_denied", "access_request_revoked", "custom_"]);

export const appEnum = z.enum(["authentik.commands", "authentik.tasks", "authentik.admin", "authentik.api", "authentik.core", "authentik.crypto", "authentik.endpoints", "authentik.endpoints.connectors.agent", "authentik.enterprise", "authentik.events", "authentik.admin.files", "authentik.flows", "authentik.outposts", "authentik.policies.dummy", "authentik.policies.event_matcher", "authentik.policies.expiry", "authentik.policies.expression", "authentik.policies.geoip", "authentik.policies.password", "authentik.policies.reputation", "authentik.policies", "authentik.providers.ldap", "authentik.providers.oauth2", "authentik.providers.proxy", "authentik.providers.rac", "authentik.providers.radius", "authentik.providers.saml", "authentik.providers.scim", "authentik.rbac", "authentik.recovery", "authentik.sources.kerberos", "authentik.sources.ldap", "authentik.sources.oauth", "authentik.sources.plex", "authentik.sources.saml", "authentik.sources.scim", "authentik.sources.telegram", "authentik.stages.authenticator", "authentik.stages.authenticator_duo", "authentik.stages.authenticator_email", "authentik.stages.authenticator_sms", "authentik.stages.authenticator_static", "authentik.stages.authenticator_totp", "authentik.stages.authenticator_validate", "authentik.stages.authenticator_webauthn", "authentik.stages.captcha", "authentik.stages.consent", "authentik.stages.deny", "authentik.stages.dummy", "authentik.stages.email", "authentik.stages.identification", "authentik.stages.invitation", "authentik.stages.password", "authentik.stages.prompt", "authentik.stages.redirect", "authentik.stages.user_delete", "authentik.stages.user_login", "authentik.stages.user_logout", "authentik.stages.user_write", "authentik.tasks.schedules", "authentik.tenants", "authentik.brands", "authentik.blueprints", "authentik.enterprise.agents", "authentik.enterprise.audit", "authentik.enterprise.endpoints.connectors.agent", "authentik.enterprise.endpoints.connectors.fleet", "authentik.enterprise.endpoints.connectors.google_chrome", "authentik.enterprise.endpoints.connectors.microsoft_intune", "authentik.enterprise.lifecycle", "authentik.enterprise.policies.unique_password", "authentik.enterprise.providers.google_workspace", "authentik.enterprise.providers.microsoft_entra", "authentik.enterprise.providers.radius", "authentik.enterprise.providers.scim", "authentik.enterprise.providers.ssf", "authentik.enterprise.providers.ws_federation", "authentik.enterprise.reports", "authentik.enterprise.requests", "authentik.enterprise.stages.account_lockdown", "authentik.enterprise.stages.authenticator_endpoint_gdtc", "authentik.enterprise.stages.mtls", "authentik.enterprise.stages.source"]);

export const modelEnum = z.enum(["authentik_core.group", "authentik_core.user", "authentik_core.application", "authentik_core.applicationentitlement", "authentik_core.token", "authentik_core.objectattribute", "authentik_core.actor", "authentik_crypto.certificatekeypair", "authentik_endpoints.deviceuserbinding", "authentik_endpoints.deviceaccessgroup", "authentik_endpoints.endpointstage", "authentik_endpoints_connectors_agent.agentconnector", "authentik_endpoints_connectors_agent.agentdeviceuserbinding", "authentik_endpoints_connectors_agent.enrollmenttoken", "authentik_enterprise.license", "authentik_events.event", "authentik_events.notificationtransport", "authentik_events.notification", "authentik_events.notificationrule", "authentik_events.notificationwebhookmapping", "authentik_flows.flow", "authentik_flows.flowstagebinding", "authentik_outposts.dockerserviceconnection", "authentik_outposts.kubernetesserviceconnection", "authentik_outposts.outpost", "authentik_policies_dummy.dummypolicy", "authentik_policies_event_matcher.eventmatcherpolicy", "authentik_policies_expiry.passwordexpirypolicy", "authentik_policies_expression.expressionpolicy", "authentik_policies_geoip.geoippolicy", "authentik_policies_password.passwordpolicy", "authentik_policies_reputation.reputationpolicy", "authentik_policies.policybinding", "authentik_providers_ldap.ldapprovider", "authentik_providers_oauth2.scopemapping", "authentik_providers_oauth2.oauth2provider", "authentik_providers_oauth2.oauth2dynamicclientregistration", "authentik_providers_proxy.proxyprovider", "authentik_providers_rac.racprovider", "authentik_providers_rac.racpropertymapping", "authentik_providers_radius.radiusprovider", "authentik_providers_radius.radiusproviderpropertymapping", "authentik_providers_saml.samlprovider", "authentik_providers_saml.samlpropertymapping", "authentik_providers_scim.scimprovider", "authentik_providers_scim.scimmapping", "authentik_rbac.role", "authentik_rbac.initialpermissions", "authentik_rbac.custompermission", "authentik_rbac.permissioncheck", "authentik_sources_kerberos.kerberossource", "authentik_sources_kerberos.kerberossourcepropertymapping", "authentik_sources_kerberos.userkerberossourceconnection", "authentik_sources_kerberos.groupkerberossourceconnection", "authentik_sources_ldap.ldapsource", "authentik_sources_ldap.ldapsourcepropertymapping", "authentik_sources_ldap.userldapsourceconnection", "authentik_sources_ldap.groupldapsourceconnection", "authentik_sources_oauth.oauthsource", "authentik_sources_oauth.oauthsourcepropertymapping", "authentik_sources_oauth.useroauthsourceconnection", "authentik_sources_oauth.groupoauthsourceconnection", "authentik_sources_plex.plexsource", "authentik_sources_plex.plexsourcepropertymapping", "authentik_sources_plex.userplexsourceconnection", "authentik_sources_plex.groupplexsourceconnection", "authentik_sources_saml.samlsource", "authentik_sources_saml.samlsourcepropertymapping", "authentik_sources_saml.usersamlsourceconnection", "authentik_sources_saml.groupsamlsourceconnection", "authentik_sources_scim.scimsource", "authentik_sources_scim.scimsourcepropertymapping", "authentik_sources_telegram.telegramsource", "authentik_sources_telegram.telegramsourcepropertymapping", "authentik_sources_telegram.usertelegramsourceconnection", "authentik_sources_telegram.grouptelegramsourceconnection", "authentik_stages_authenticator_duo.authenticatorduostage", "authentik_stages_authenticator_duo.duodevice", "authentik_stages_authenticator_email.authenticatoremailstage", "authentik_stages_authenticator_email.emaildevice", "authentik_stages_authenticator_sms.authenticatorsmsstage", "authentik_stages_authenticator_sms.smsdevice", "authentik_stages_authenticator_static.authenticatorstaticstage", "authentik_stages_authenticator_static.staticdevice", "authentik_stages_authenticator_totp.authenticatortotpstage", "authentik_stages_authenticator_totp.totpdevice", "authentik_stages_authenticator_validate.authenticatorvalidatestage", "authentik_stages_authenticator_webauthn.authenticatorwebauthnstage", "authentik_stages_authenticator_webauthn.webauthndevice", "authentik_stages_captcha.captchastage", "authentik_stages_consent.consentstage", "authentik_stages_deny.denystage", "authentik_stages_dummy.dummystage", "authentik_stages_email.emailstage", "authentik_stages_identification.identificationstage", "authentik_stages_invitation.invitationstage", "authentik_stages_invitation.invitation", "authentik_stages_password.passwordstage", "authentik_stages_prompt.prompt", "authentik_stages_prompt.promptstage", "authentik_stages_redirect.redirectstage", "authentik_stages_user_delete.userdeletestage", "authentik_stages_user_login.userloginstage", "authentik_stages_user_logout.userlogoutstage", "authentik_stages_user_write.userwritestage", "authentik_tasks_schedules.schedule", "authentik_brands.brand", "authentik_blueprints.blueprintinstance", "authentik_agents.agent", "authentik_endpoints_connectors_fleet.fleetconnector", "authentik_endpoints_connectors_google_chrome.googlechromeconnector", "authentik_endpoints_connectors_microsoft_intune.microsoftintuneconnector", "authentik_lifecycle.lifecyclerule", "authentik_lifecycle.lifecycleiteration", "authentik_lifecycle.review", "authentik_lifecycle.useroffboarding", "authentik_policies_unique_password.uniquepasswordpolicy", "authentik_providers_google_workspace.googleworkspaceprovider", "authentik_providers_google_workspace.googleworkspaceprovidermapping", "authentik_providers_microsoft_entra.microsoftentraprovider", "authentik_providers_microsoft_entra.microsoftentraprovidermapping", "authentik_providers_ssf.ssfprovider", "authentik_providers_ws_federation.wsfederationprovider", "authentik_reports.dataexport", "authentik_requests.requestrulechildbinding", "authentik_requests.requestrulebinding", "authentik_requests.requestrule", "authentik_requests.grantrequest", "authentik_stages_account_lockdown.accountlockdownstage", "authentik_stages_authenticator_endpoint_gdtc.authenticatorendpointgdtcstage", "authentik_stages_mtls.mutualtlsstage", "authentik_stages_source.sourcestage"]);

export const eventMatcherPolicy = z.object({pk: z.string(), name: z.string(), execution_logging: z.boolean().optional(), component: z.string(), verbose_name: z.string(), verbose_name_plural: z.string(), meta_model_name: z.string(), bound_to: z.number().int(), last_updated: z.string(), created: z.string(), action: eventActions.nullable().optional(), client_ip: z.string().nullable().optional(), app: appEnum.nullable().optional(), model: modelEnum.nullable().optional(), query: z.string().nullable().optional()});

export const validateResponse = async <Output>(
  schema: {
    readonly '~standard': {
      readonly validate: (value: unknown) => ({ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }) | Promise<{ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }>
    }
  },
  value: unknown
): Promise<Output> => {
  const result = await schema['~standard'].validate(value)

  if (result.issues !== undefined) {
    const detail = result.issues
      .map(({ message, path }) =>
        path?.length
          ? `${path.map((segment) => String(typeof segment === 'object' ? segment.key : segment)).join('.')}: ${message}`
          : message
      )
      .join('; ')

    throw new Error(`Response does not match the schema: ${detail}`, { cause: { issues: result.issues } })
  }

  return result.value
};

/**
 * Event Matcher Policy Viewset
 * 
 * PUT /policies/event_matcher/{policy_uuid}/
 */
export const updateApiPoliciesEventMatcherPolicyUuid = async (args: UpdateApiPoliciesEventMatcherPolicyUuidArgs, options: UpdateApiPoliciesEventMatcherPolicyUuidOptions) => {
const {baseUrl, fetch: fetchFn = fetch, authentik} = options ?? {}

const query = new URLSearchParams()
const headers = new Headers()
headers.set('content-type', "application/json")
headers.set('accept', "application/json")

if (authentik !== undefined) headers.set('authorization', `Bearer ${authentik}`)

const url = `${baseUrl.replace(/\/+$/, '')}/policies/event_matcher/${encodeURIComponent(String(args.policy_uuid))}/${query.size > 0 ? `?${query}` : ''}`

const res = await fetchFn(url, {method: "PUT", headers, body: JSON.stringify(args.body)})

if (!res.ok) throw new Error(`Request failed with status ${res.status}`, {cause: {status: res.status, body: await res.text()}})

return validateResponse(eventMatcherPolicy, await res.json())
};