/**
 * Zod request bodies for tenant auth routes — foundation-auth-rbac (Task 12).
 * `require-zod-validation-in-routes` requires `await c.req.json()` to be parsed
 * directly by one of these schemas.
 *
 * Password policy: min 8, no max, no truncation (PBKDF2 takes the full UTF-8
 * byte string). Enforced here at the Zod layer per the spec.
 */
import { z } from 'zod'

export const signupSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8),
  businessName: z.string().min(1).max(200),
})

export const loginSchema = z.object({
  email: z.string().email(),
  password: z.string().min(1),
})

export const switchTenantSchema = z.object({
  tenantId: z.string().uuid(),
})

export const forgotPasswordSchema = z.object({
  email: z.string().email(),
})

export const resetPasswordSchema = z.object({
  token: z.string().min(1),
  password: z.string().min(8),
})

export const createInviteSchema = z.object({
  email: z.string().email(),
  roleId: z.string().uuid(),
})

export const acceptInviteSchema = z.object({
  token: z.string().min(1),
  // Provided only when the invited email has no existing account (mini-signup).
  fullName: z.string().min(1).max(200).optional(),
  password: z.string().min(8).optional(),
})

export const freezeSchema = z.object({
  userId: z.string().uuid(),
  reason: z.string().min(1).max(500),
})

export type SignupBody = z.infer<typeof signupSchema>
export type LoginBody = z.infer<typeof loginSchema>
export type SwitchTenantBody = z.infer<typeof switchTenantSchema>
export type ForgotPasswordBody = z.infer<typeof forgotPasswordSchema>
export type ResetPasswordBody = z.infer<typeof resetPasswordSchema>
export type CreateInviteBody = z.infer<typeof createInviteSchema>
export type AcceptInviteBody = z.infer<typeof acceptInviteSchema>
export type FreezeBody = z.infer<typeof freezeSchema>