export interface ApprovalRequest {
  id: string;
  toolName: string;
  action: string;
  parameters: any;
  riskLevel: 'low' | 'medium' | 'high' | 'critical';
  impact: string[];
  reversible: boolean;
  requestedAt: Date;
  requestedBy: string;
  status: 'pending' | 'approved' | 'rejected' | 'expired';
  approvedBy?: string;
  approvedAt?: Date;
  rejectedBy?: string;
  rejectedAt?: Date;
  rejectionReason?: string;
  ttl: number; // Time to live in seconds
  expiresAt: Date;
  metadata?: Record<string, any>;
}

export interface ToolPolicy {
  toolName: string;
  description: string;
  actions: Record<string, ActionPolicy>;
  defaultPolicy?: ActionPolicy;
}

export interface ActionPolicy {
  action: string;
  requiresApproval: boolean;
  approvalLevel: 'user' | 'admin' | 'owner';
  riskLevel: 'low' | 'medium' | 'high' | 'critical';
  conditions?: PolicyCondition[];
  auditLog: boolean;
  autoApprove?: AutoApprovePolicy;
  notifyChannels?: string[];
}

export interface PolicyCondition {
  field: string;
  operator: 'equals' | 'contains' | 'greater_than' | 'less_than' | 'in' | 'not_in';
  value: any;
  combineWith?: 'and' | 'or';
}

export interface AutoApprovePolicy {
  enabled: boolean;
  conditions: PolicyCondition[];
  maxAutoApprovals?: number;
  timeWindow?: number; // seconds
}

export interface ApprovalStore {
  requests: Record<string, ApprovalRequest>;
  policies: Record<string, ToolPolicy>;
  auditLog: AuditLogEntry[];
}

export interface AuditLogEntry {
  id: string;
  timestamp: Date;
  userId: string;
  action: string;
  toolName: string;
  parameters: any;
  result: 'approved' | 'rejected' | 'auto_approved' | 'expired';
  riskLevel: string;
  metadata?: Record<string, any>;
}

export interface ApprovalNotification {
  id: string;
  requestId: string;
  userId: string;
  type: 'new_request' | 'approved' | 'rejected' | 'expired' | 'reminder';
  message: string;
  createdAt: Date;
  read: boolean;
}

// High-risk operations that always require approval
export const HIGH_RISK_OPERATIONS = {
  'deployment-management': {
    'deploy_to_production': { riskLevel: 'critical', impact: ['production_environment', 'user_data'] },
    'rollback_deployment': { riskLevel: 'high', impact: ['service_availability'] },
    'delete_environment': { riskLevel: 'high', impact: ['data_loss'] },
  },
  'process-automation': {
    'execute_process': { riskLevel: 'medium', impact: ['automated_actions'] },
    'create_webhook_trigger': { riskLevel: 'medium', impact: ['external_access'] },
    'delete_all_processes': { riskLevel: 'high', impact: ['data_loss'] },
  },
  'data-management': {
    'clear_all_data': { riskLevel: 'critical', impact: ['data_loss', 'irreversible'] },
    'bulk_delete': { riskLevel: 'high', impact: ['data_loss'] },
    'export_sensitive_data': { riskLevel: 'high', impact: ['data_exposure'] },
  },
  'git-workflow': {
    'force_push': { riskLevel: 'high', impact: ['code_loss', 'team_disruption'] },
    'delete_branch': { riskLevel: 'medium', impact: ['code_loss'] },
    'reset_hard': { riskLevel: 'high', impact: ['code_loss', 'irreversible'] },
  },
  'business-guidance': {
    'publish_financial_projection': { riskLevel: 'high', impact: ['legal_liability'] },
    'send_investor_update': { riskLevel: 'critical', impact: ['investor_relations'] },
  },
  'migration-management': {
    'execute_migration': { riskLevel: 'high', impact: ['data_integrity'] },
    'rollback_migration': { riskLevel: 'high', impact: ['data_integrity'] },
  }
};