import { z } from 'zod';
import { RbacRoleBindingSchema } from './rbac-definition.schema.js';

export const McpTokenRbacMode = z.enum(['empty', 'clone']);
export type McpTokenRbacMode = z.infer<typeof McpTokenRbacMode>;

export const CreateMcpTokenSchema = z.object({
  name: z
    .string()
    .min(1)
    .max(100)
    .regex(/^[a-z0-9-]+$/, 'Name must be lowercase alphanumeric with hyphens'),
  projectId: z.string().min(1),
  description: z.string().optional(),
  expiresAt: z.union([z.string().datetime(), z.date(), z.null()]).optional(),
  rbacMode: McpTokenRbacMode.default('empty'),
  /** Explicit bindings, added on top of the `rbacMode` base (empty or clone). */
  bindings: z.array(RbacRoleBindingSchema).default([]),
});

export type CreateMcpTokenInput = z.infer<typeof CreateMcpTokenSchema>;
