export interface SSOConfig {
  id: string
  tenant_id: string
  provider_type: 'oidc' | 'saml'
  name: string
  enabled: boolean
  oidc_issuer_url: string
  oidc_client_id: string
  oidc_client_secret: string
  oidc_redirect_uri: string
  oidc_scopes: string[]
  role_mapping: Record<string, string>
  default_role_id: string | null
  auto_provision: boolean
  created_at: string
  updated_at: string
}

export interface RoleMapping {
  sso_group: string
  internal_role: string
}

export interface SSOUser {
  id: string
  tenant_id: string
  sso_config_id: string
  external_id: string
  email: string
  display_name: string
  groups: string[]
  last_login: string | null
  is_active: boolean
  created_at: string
  updated_at: string
}

export interface SSOFormData {
  name: string
  provider_type: 'oidc'
  issuer_url: string
  client_id: string
  client_secret: string
  redirect_uri: string
  scopes: string
  auto_provision: boolean
  default_role: string
  role_mappings: RoleMapping[]
}

export interface ConnectionTestResult {
  success: boolean
  message: string
  details?: {
    issuer_reachable: boolean
    jwks_available: boolean
    authorization_endpoint: string
    token_endpoint: string
  }
}

export type TabId = 'configs' | 'users' | 'info'
