use clap::Subcommand;

use crate::commands;

#[derive(Subcommand)]
pub enum PublicAdminCommands {
    /// Access request operations
    Access {
        #[command(subcommand)]
        command: commands::access::AccessCommands,
    },
    /// Account operations
    Account {
        #[command(subcommand)]
        command: commands::account::AccountCommands,
    },
    /// Authenticate with the Kura API via OAuth
    Login {
        /// Use OAuth Device Authorization flow (code entry in browser UI)
        #[arg(long)]
        device: bool,
    },
    /// Remove stored credentials
    Logout,
    /// Specialist admin operations (bootstrapping and user management)
    Ops {
        #[command(subcommand)]
        command: commands::admin::AdminCommands,
    },
    /// Create a new user (compatibility alias)
    #[command(hide = true)]
    CreateUser {
        /// User email
        #[arg(long)]
        email: String,
        /// User password
        #[arg(long)]
        password: String,
        /// Display name
        #[arg(long)]
        display_name: Option<String>,
    },
    /// Create an API key for a user (compatibility alias)
    #[command(hide = true)]
    CreateKey {
        /// User UUID
        #[arg(long)]
        user_id: String,
        /// Human-readable label (e.g. "my-ci-server")
        #[arg(long)]
        label: String,
        /// Expiration in days (default: never)
        #[arg(long)]
        expires_in_days: Option<i64>,
    },
    /// Permanently delete a user and all their data (compatibility alias)
    #[command(hide = true)]
    DeleteUser {
        /// User UUID to delete
        #[arg(long)]
        user_id: String,
        /// Confirm deletion (required)
        #[arg(long)]
        confirm: bool,
    },
    /// List access requests (compatibility alias)
    #[command(hide = true)]
    ListRequests {
        /// Filter by status: pending, approved, rejected
        #[arg(long, default_value = "pending")]
        status: String,
    },
    /// Approve an access request and generate invite token (compatibility alias)
    #[command(hide = true)]
    ApproveRequest {
        /// Access request UUID
        id: String,
    },
    /// Reject an access request (compatibility alias)
    #[command(hide = true)]
    RejectRequest {
        /// Access request UUID
        id: String,
    },
    /// Create a manual invite token (compatibility alias)
    #[command(hide = true)]
    CreateInvite {
        /// Bind to specific email (optional)
        #[arg(long)]
        email: Option<String>,
        /// Expiration in days (default: 7)
        #[arg(long, default_value = "7")]
        expires_in_days: i64,
    },
    /// List invite tokens (compatibility alias)
    #[command(hide = true)]
    ListInvites {
        /// Filter: unused, used, expired
        #[arg(long)]
        status: Option<String>,
    },
    /// Audited break-glass identity lookup by user UUID (compatibility alias)
    #[command(hide = true)]
    SupportReidentify {
        /// Target user UUID
        #[arg(long)]
        user_id: String,
        /// Mandatory operational reason
        #[arg(long)]
        reason: String,
        /// Incident/support ticket reference
        #[arg(long)]
        ticket_id: String,
        /// Requested mode (identity_lookup|incident_debug)
        #[arg(long)]
        requested_mode: Option<String>,
        /// Optional RFC3339 expiry timestamp for this access grant
        #[arg(long)]
        expires_at: Option<String>,
    },
    /// Agent telemetry endpoints (compatibility alias)
    #[command(hide = true)]
    Telemetry {
        #[command(subcommand)]
        command: commands::admin::AdminTelemetryCommands,
    },
}
