using OmsorgCore.Application.Models;
using OmsorgCore.Domain.Enums;

namespace OmsorgCore.Application.Services;

public interface IUserService
{
    Task<IReadOnlyList<UserSummary>> GetAllAsync(CancellationToken cancellationToken = default);

    Task<CreateUserResult> CreateForEmployeeAsync(
        Guid employeeId,
        string username,
        Guid roleId,
        UserCreationMode mode,
        string? initialPassword,
        TimeSpan? invitePinValidity,
        CancellationToken cancellationToken = default);

    Task<ChangeOwnPasswordResult> ChangeOwnPasswordAsync(
        Guid userId,
        string currentPassword,
        string newPassword,
        CancellationToken cancellationToken = default);

    /// <summary>Admin setzt das Passwort eines bestehenden Users zurück (Invite-PIN oder direktes Passwort) - spiegelt CreateForEmployeeAsync, aber ohne Neuanlage.</summary>
    Task<AdminResetPasswordResult> AdminResetPasswordAsync(
        Guid userId,
        UserCreationMode mode,
        string? initialPassword,
        TimeSpan? invitePinValidity,
        CancellationToken cancellationToken = default);

    /// <summary>Rolle und/oder Aktiv-Status ändern. Deaktivieren beendet sofort alle Sessions (kein Hard-Delete).</summary>
    Task<UpdateUserResult> UpdateAsync(
        Guid userId,
        Guid roleId,
        bool isActive,
        CancellationToken cancellationToken = default);

    /// <summary>Individuelle Rechte-Ausnahmen eines Users (überschreiben den Rollen-Default, siehe PermissionService).</summary>
    Task<IReadOnlyList<PermissionOverrideSummary>?> GetPermissionOverridesAsync(
        Guid userId,
        CancellationToken cancellationToken = default);

    /// <summary>Upsert: existiert bereits ein Override für (module, action) bei diesem User, werden dessen Effect und Scope aktualisiert statt dupliziert.</summary>
    Task<AddPermissionOverrideResult> AddPermissionOverrideAsync(
        Guid userId,
        ModuleType module,
        PermissionAction action,
        PermissionEffect effect,
        PermissionScope scope,
        CancellationToken cancellationToken = default);

    Task<RemovePermissionOverrideResult> RemovePermissionOverrideAsync(
        Guid userId,
        Guid overrideId,
        CancellationToken cancellationToken = default);
}
