"use client";
import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
import { useCallback, useState } from "react";
import { cn } from "@stigmer/theme";
import { getUserMessage } from "@stigmer/sdk";
import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
import { useCreateIdentityProvider } from "./useCreateIdentityProvider";
/**
 * Form for creating a new identity provider within an organization.
 *
 * Collects the required OIDC trust configuration: **name** (display
 * name), **JWKS URI**, **allowed issuers**, and **expected audience**.
 * Optionally enables SSO by toggling the SSO switch and providing an
 * **OIDC client ID**.
 *
 * On success it fires `onCreated` with the full {@link IdentityProvider}
 * response.
 *
 * All visual properties flow through `--stgm-*` design tokens.
 *
 * @example
 * ```tsx
 * <CreateIdentityProviderForm
 *   org="acme"
 *   onCreated={(idp) => {
 *     refetch();
 *     setShowForm(false);
 *   }}
 *   onCancel={() => setShowForm(false)}
 * />
 * ```
 */
export function CreateIdentityProviderForm({ org, onCreated, onCancel, className, }) {
    const { create, isCreating, error, clearError } = useCreateIdentityProvider();
    const [name, setName] = useState("");
    const [jwksUri, setJwksUri] = useState("");
    const [issuers, setIssuers] = useState("");
    const [audience, setAudience] = useState("");
    const [isSso, setIsSso] = useState(false);
    const [oidcClientId, setOidcClientId] = useState("");
    // JIT provisioning
    const [autoProvision, setAutoProvision] = useState(false);
    const [autoGrant, setAutoGrant] = useState(false);
    const [autoGrantRole, setAutoGrantRole] = useState(IamRole.iam_role_unspecified);
    const [tenantOrgClaim, setTenantOrgClaim] = useState("");
    const handleAutoProvisionChange = useCallback((v) => {
        setAutoProvision(v);
        if (!v) {
            setAutoGrant(false);
            setAutoGrantRole(IamRole.iam_role_unspecified);
            setTenantOrgClaim("");
        }
    }, []);
    const handleAutoGrantChange = useCallback((v) => {
        setAutoGrant(v);
        if (v)
            setAutoProvision(true);
        if (!v) {
            setAutoGrantRole(IamRole.iam_role_unspecified);
            setTenantOrgClaim("");
        }
    }, []);
    const trimmedName = name.trim();
    const trimmedJwksUri = jwksUri.trim();
    const trimmedIssuers = issuers.trim();
    const trimmedAudience = audience.trim();
    const canSubmit = trimmedName !== "" &&
        trimmedJwksUri !== "" &&
        trimmedIssuers !== "" &&
        trimmedAudience !== "" &&
        (!isSso || oidcClientId.trim() !== "") &&
        !isCreating;
    const handleSubmit = useCallback(async (e) => {
        e.preventDefault();
        if (!canSubmit)
            return;
        clearError();
        try {
            const idp = await create({
                name: trimmedName,
                org,
                jwksUri: trimmedJwksUri,
                allowedIssuers: trimmedIssuers
                    .split(",")
                    .map((s) => s.trim())
                    .filter(Boolean),
                expectedAudience: trimmedAudience,
                ...(isSso && {
                    isSsoProvider: true,
                    oidcClientId: oidcClientId.trim(),
                }),
                ...(!isSso && {
                    autoProvisionAccounts: autoProvision,
                    autoGrantOnOrg: autoGrant,
                    ...(autoGrant && autoGrantRole !== IamRole.iam_role_unspecified && {
                        autoGrantRole,
                    }),
                    ...(autoGrant && tenantOrgClaim.trim() && {
                        tenantOrgClaim: tenantOrgClaim.trim(),
                    }),
                }),
            });
            onCreated?.(idp);
        }
        catch {
            // error state is managed by useCreateIdentityProvider
        }
    }, [
        canSubmit,
        trimmedName,
        org,
        trimmedJwksUri,
        trimmedIssuers,
        trimmedAudience,
        isSso,
        oidcClientId,
        autoProvision,
        autoGrant,
        autoGrantRole,
        tenantOrgClaim,
        create,
        clearError,
        onCreated,
    ]);
    return (_jsxs("form", { onSubmit: handleSubmit, className: cn("space-y-3", className), children: [_jsxs("div", { className: "space-y-3", children: [_jsx(FormField, { id: "stgm-idp-name", label: "Name", value: name, onChange: setName, placeholder: "e.g. Acme Corp SSO", disabled: isCreating, required: true }), _jsx(FormField, { id: "stgm-idp-jwks", label: "JWKS URI", value: jwksUri, onChange: setJwksUri, placeholder: "https://example.com/.well-known/jwks.json", disabled: isCreating, required: true }), _jsx(FormField, { id: "stgm-idp-issuers", label: "Allowed issuers", value: issuers, onChange: setIssuers, placeholder: "issuer-1, issuer-2", hint: "Comma-separated list of trusted JWT issuer values", disabled: isCreating, required: true }), _jsx(FormField, { id: "stgm-idp-audience", label: "Expected audience", value: audience, onChange: setAudience, placeholder: "stigmer-api", disabled: isCreating, required: true }), _jsxs("div", { className: "flex items-center gap-2", children: [_jsx("button", { type: "button", role: "switch", "aria-checked": isSso, onClick: () => setIsSso((v) => !v), disabled: isCreating, className: cn("relative inline-flex h-5 w-9 shrink-0 cursor-pointer rounded-full border-2 border-transparent transition-colors", isSso ? "bg-primary" : "bg-muted", "disabled:pointer-events-none disabled:opacity-50"), children: _jsx("span", { className: cn("pointer-events-none inline-block h-4 w-4 rounded-full bg-background shadow-sm ring-0 transition-transform", isSso ? "translate-x-4" : "translate-x-0") }) }), _jsx("span", { className: "text-xs font-medium text-foreground", children: "SSO provider" })] }), isSso && (_jsx(FormField, { id: "stgm-idp-client-id", label: "OIDC client ID", value: oidcClientId, onChange: setOidcClientId, placeholder: "public-client-id", hint: "Client ID for the PKCE-based Authorization Code flow", disabled: isCreating, required: true })), _jsx(JitSection, { isSso: isSso, autoProvision: autoProvision, onAutoProvisionChange: handleAutoProvisionChange, autoGrant: autoGrant, onAutoGrantChange: handleAutoGrantChange, autoGrantRole: autoGrantRole, onAutoGrantRoleChange: setAutoGrantRole, tenantOrgClaim: tenantOrgClaim, onTenantOrgClaimChange: setTenantOrgClaim, disabled: isCreating })] }), error && (_jsx("p", { className: "text-destructive text-[0.65rem]", role: "alert", children: getUserMessage(error) })), _jsxs("div", { className: "flex items-center gap-2", children: [_jsxs("button", { type: "submit", disabled: !canSubmit, className: cn("inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium", "bg-primary text-primary-foreground hover:bg-primary-hover", "disabled:pointer-events-none disabled:opacity-40"), children: [isCreating && _jsx(SpinnerIcon, {}), "Create identity provider"] }), onCancel && (_jsx("button", { type: "button", onClick: onCancel, disabled: isCreating, className: cn("rounded-md px-3 py-1.5 text-xs", "text-muted-foreground hover:text-foreground hover:bg-accent-hover", "disabled:pointer-events-none disabled:opacity-50"), children: "Cancel" }))] })] }));
}
// ---------------------------------------------------------------------------
// FormField (internal)
// ---------------------------------------------------------------------------
function FormField({ id, label, value, onChange, placeholder, hint, disabled, required, }) {
    return (_jsxs("div", { className: "space-y-1", children: [_jsx("label", { htmlFor: id, className: "text-xs font-medium text-foreground", children: label }), _jsx("input", { id: id, type: "text", value: value, onChange: (e) => onChange(e.target.value), placeholder: placeholder, disabled: disabled, required: required, className: cn("w-full rounded-md border border-input bg-background px-2.5 py-1.5 text-xs text-foreground", "placeholder:text-muted-foreground", "focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring", "disabled:pointer-events-none disabled:opacity-50") }), hint && (_jsx("p", { className: "text-[0.65rem] text-muted-foreground", children: hint }))] }));
}
// ---------------------------------------------------------------------------
// JIT provisioning section
// ---------------------------------------------------------------------------
const JIT_ROLE_OPTIONS = [
    { value: String(IamRole.iam_role_unspecified), label: "Default (viewer)" },
    { value: String(IamRole.viewer), label: "Viewer" },
    { value: String(IamRole.member), label: "Member" },
    { value: String(IamRole.admin), label: "Admin" },
];
function JitSection({ isSso, autoProvision, onAutoProvisionChange, autoGrant, onAutoGrantChange, autoGrantRole, onAutoGrantRoleChange, tenantOrgClaim, onTenantOrgClaimChange, disabled, }) {
    if (isSso) {
        return (_jsx("div", { className: "rounded-md border border-border-muted bg-muted-faint px-3 py-2", children: _jsxs("p", { className: "text-[0.65rem] text-muted-foreground", children: ["SSO providers automatically provision accounts and grant the", " ", _jsx("span", { className: "font-medium text-foreground", children: "viewer" }), " role on the owning organization. JIT provisioning settings are not applicable."] }) }));
    }
    return (_jsxs("fieldset", { className: "space-y-2.5", disabled: disabled, children: [_jsx("hr", { className: "border-border-muted" }), _jsx("legend", { className: "text-xs font-medium text-foreground", children: "JIT provisioning" }), _jsx("p", { className: "text-[0.65rem] text-muted-foreground", children: "Configure automatic account creation and role assignment for users authenticating with this provider." }), _jsx(ToggleSwitch, { checked: autoProvision, onChange: onAutoProvisionChange, label: "Auto-provision accounts", hint: "Create a federated account automatically on first authentication", disabled: disabled }), _jsx(ToggleSwitch, { checked: autoGrant, onChange: onAutoGrantChange, label: "Auto-grant on organization", hint: "Grant a role on the owning organization when an account is provisioned", disabled: disabled || !autoProvision }), autoGrant && (_jsxs(_Fragment, { children: [_jsxs("div", { className: "space-y-1", children: [_jsx("label", { htmlFor: "stgm-idp-grant-role", className: "text-xs font-medium text-foreground", children: "Auto-grant role" }), _jsx("select", { id: "stgm-idp-grant-role", value: String(autoGrantRole), onChange: (e) => onAutoGrantRoleChange(Number(e.target.value)), disabled: disabled, className: cn("w-full rounded-md border border-input bg-background px-2.5 py-1.5 text-xs text-foreground", "focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring", "disabled:pointer-events-none disabled:opacity-50"), children: JIT_ROLE_OPTIONS.map((opt) => (_jsx("option", { value: opt.value, children: opt.label }, opt.value))) }), _jsx("p", { className: "text-[0.65rem] text-muted-foreground", children: "Role granted automatically \u2014 org admins can upgrade later" })] }), _jsx(FormField, { id: "stgm-idp-tenant-claim", label: "Tenant org claim", value: tenantOrgClaim, onChange: onTenantOrgClaimChange, placeholder: "e.g., org_id", hint: "JWT claim name that maps to a platform-managed organization (max 256 chars)", disabled: disabled })] }))] }));
}
// ---------------------------------------------------------------------------
// Toggle switch
// ---------------------------------------------------------------------------
function ToggleSwitch({ checked, onChange, label, hint, disabled, }) {
    return (_jsxs("div", { className: "space-y-0.5", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx("button", { type: "button", role: "switch", "aria-checked": checked, onClick: () => onChange(!checked), disabled: disabled, className: cn("relative inline-flex h-5 w-9 shrink-0 cursor-pointer rounded-full border-2 border-transparent transition-colors", checked ? "bg-primary" : "bg-muted", "disabled:pointer-events-none disabled:opacity-50"), children: _jsx("span", { className: cn("pointer-events-none inline-block h-4 w-4 rounded-full bg-background shadow-sm ring-0 transition-transform", checked ? "translate-x-4" : "translate-x-0") }) }), _jsx("span", { className: "text-xs font-medium text-foreground", children: label })] }), hint && (_jsx("p", { className: "pl-11 text-[0.65rem] text-muted-foreground", children: hint }))] }));
}
// ---------------------------------------------------------------------------
// Icons
// ---------------------------------------------------------------------------
function SpinnerIcon() {
    return (_jsx("svg", { width: "12", height: "12", viewBox: "0 0 16 16", fill: "none", stroke: "currentColor", strokeWidth: "2", strokeLinecap: "round", className: "animate-spin", "aria-hidden": "true", children: _jsx("path", { d: "M8 2a6 6 0 1 0 6 6" }) }));
}
//# sourceMappingURL=CreateIdentityProviderForm.js.map