/*
 * Copyright (C) 2019 Robert Bosch GmbH Copyright (C) 2019 Robert Bosch Manufacturing Solutions GmbH, Germany. All rights reserved.
 */

import { DefaultAuthModuleConfig, IAuthModuleConfig, IAuthModuleOptions } from '../auth.options';
import { Observable } from 'rxjs';

// eslint-disable-next-line @typescript-eslint/no-empty-interface
export interface IMacmaAuthModuleOptions extends IAuthModuleOptions { }

export interface IMacmaAuthModuleConfig extends IAuthModuleConfig {
  /**
   * Id of the client representing this application.
   */
  clientId?: string | Observable<string>;

  /**
   * OIDC scopes
   */
  scope?: string;

  /**
   * Default realm / tenant to use for login.
   */
  defaultRealm?: string | Observable<string>;

  /**
   * Path to auth assets (e.g. for callback handling) relative to base href.
   */
  authAssetsPath?: string;

  /**
   * Try to use popup for login with redirection only as fallback.
   */
  usePopup?: boolean;

  /**
   * Query Param used for realm. Defaults to "tenant"
   */
  queryParamRealm?: string;

  /**
   * Should the user info request be made automatically. Defaults to false;
   */
  requestUserInfo?: boolean;

  /**
   * Determines if the refresh_token flow should be executed when refreshing a user token.
   * If set to false, the authentication_code flow will be executed instead.
   * Default: false
   */
  useRefreshToken?: boolean;

  autoLogin?: boolean;

  /**
   * Path to the ACL relative to the authorization server base url.
   */
  aclPath?: string | Observable<string>;

  /**
   * Determines the interval how often the acl is reloaded from MACMA.
   * Because this is a time consuming operation it should not be to short.
   * Suggested: every minute = 60000
   */
  aclReloadIntervalMs?: number;

  /**
   * Determines query parameter used to scope sessionStorage used for auth flow to allow
   * concurrent auth flow execution for the same client id.
   * Enables scoped sessionStorage if set. If the query parameter is not found the
   * sessionStorage will not be scoped.
   * Default: undefined
   * Suggested: If you need your application to run in multiple frames in parallel on
   * the same page, a discriminator should be provided.
   * Note: The name "redirectStorageScope" is reserved.
   */
  queryParamStorageScopeDiscriminator?: string;
}

/* tslint:disable:variable-name */
export const DefaultMacmaAuthModuleConfig: IMacmaAuthModuleConfig = {
  ...DefaultAuthModuleConfig,
  // refresh tokens seem to require scope "offline_access"
  scope: 'openid email profile',
  authAssetsPath: 'assets/auth/',
  usePopup: true,
  queryParamRealm: 'tenant',
  requestUserInfo: false,
  autoLogin: true,
  // silent renew without acces token may fail if auth-server is cross origin due to browser tracking protection
  useRefreshToken: false, // might require scope "offline_access"
  aclPath: '/access-management/v1/user/acl', // consider using '/ac-identity/v2/user/acl' for Access Control 3
  queryParamStorageScopeDiscriminator: undefined,
};

/* tslint:enable:variable-name */
