import { Request } from 'express';
import { Role } from '../common/role.enum';
import { GuestJwtPayload } from './guest-auth.service';

export interface AuthenticatedMembership {
  kcId: string;
  gemeindeId: string | null;
  role: Role;
}

/// Shape attached to req.user after validating an access token — by
/// AuthentikStrategy for Authentik-backed members, or by TeamJwtStrategy for
/// local Gemeinde Teamer (then `authentikSub` is null).
export interface AuthenticatedUser {
  userId: string;
  authentikSub: string | null;
  email: string;
  memberships: AuthenticatedMembership[];
}

export interface AuthenticatedRequest extends Request {
  user?: AuthenticatedUser;
}

/// Shape attached to req.user by GuestJwtStrategy for guest/Konfi-authenticated routes.
export interface GuestAuthenticatedRequest extends Request {
  user?: GuestJwtPayload;
}