//! Credential policy operations.

use crate::zeroid::{
    client::{parse_api_error, ZeroIDClient},
    error::ZeroIDError,
    types::{
        CreateCredentialPolicyRequest, CredentialPolicy, CredentialPolicyList,
        UpdateCredentialPolicyRequest,
    },
};

/// Policies resource — CRUD on `/api/v1/credential-policies`.
pub struct PoliciesResource<'a> {
    pub(crate) client: &'a ZeroIDClient,
}

impl<'a> PoliciesResource<'a> {
    /// Create a credential policy.
    ///
    /// `POST /api/v1/credential-policies`
    pub async fn create(
        &self,
        request: &CreateCredentialPolicyRequest,
    ) -> Result<CredentialPolicy, ZeroIDError> {
        let body = serde_json::to_value(request)?;
        let headers = self.client.admin_headers();
        let resp = self
            .client
            .send_with_retry(
                reqwest::Method::POST,
                "/api/v1/credential-policies",
                headers,
                Some(&body),
            )
            .await?;
        if !resp.status().is_success() {
            return Err(parse_api_error(resp).await);
        }
        Ok(resp.json().await?)
    }

    /// Get a credential policy by ID.
    ///
    /// `GET /api/v1/credential-policies/{id}`
    pub async fn get(&self, id: &str) -> Result<CredentialPolicy, ZeroIDError> {
        let path = format!("/api/v1/credential-policies/{id}");
        let headers = self.client.admin_headers();
        let resp = self
            .client
            .send_with_retry(reqwest::Method::GET, &path, headers, None)
            .await?;
        if !resp.status().is_success() {
            return Err(parse_api_error(resp).await);
        }
        Ok(resp.json().await?)
    }

    /// List credential policies for the current tenant.
    ///
    /// `GET /api/v1/credential-policies`
    pub async fn list(&self) -> Result<CredentialPolicyList, ZeroIDError> {
        let headers = self.client.admin_headers();
        let resp = self
            .client
            .send_with_retry(
                reqwest::Method::GET,
                "/api/v1/credential-policies",
                headers,
                None,
            )
            .await?;
        if !resp.status().is_success() {
            return Err(parse_api_error(resp).await);
        }
        Ok(resp.json().await?)
    }

    /// Update a credential policy.
    ///
    /// `PATCH /api/v1/credential-policies/{id}`
    pub async fn update(
        &self,
        id: &str,
        request: &UpdateCredentialPolicyRequest,
    ) -> Result<CredentialPolicy, ZeroIDError> {
        let path = format!("/api/v1/credential-policies/{id}");
        let body = serde_json::to_value(request)?;
        let headers = self.client.admin_headers();
        let resp = self
            .client
            .send_with_retry(reqwest::Method::PATCH, &path, headers, Some(&body))
            .await?;
        if !resp.status().is_success() {
            return Err(parse_api_error(resp).await);
        }
        Ok(resp.json().await?)
    }

    /// Delete a credential policy.
    ///
    /// `DELETE /api/v1/credential-policies/{id}`
    pub async fn delete(&self, id: &str) -> Result<(), ZeroIDError> {
        let path = format!("/api/v1/credential-policies/{id}");
        let headers = self.client.admin_headers();
        let resp = self
            .client
            .send_with_retry(reqwest::Method::DELETE, &path, headers, None)
            .await?;
        if !resp.status().is_success() {
            return Err(parse_api_error(resp).await);
        }
        Ok(())
    }
}
