interface UserAuthorizationConfig {
  jwt: JWTConfig;
  oauth: OAuthConfig;
  mfa: MFAConfig;
  security: SecurityConfig;
  privacy: PrivacyConfig;
}

interface JWTConfig {
  issuer: string;
  audience: string[];
  accessTokenExpiry: number; // seconds
  refreshTokenExpiry: number; // seconds
  algorithm: 'RS256' | 'ES256' | 'HS256';
  publicKeyUrl?: string;
  secretKey?: string;
}

interface OAuthConfig {
  providers: OAuthProvider[];
  redirectUri: string;
  stateExpiry: number; // seconds
}

interface OAuthProvider {
  name: string;
  clientId: string;
  clientSecret: string;
  authorizationUrl: string;
  tokenUrl: string;
  userInfoUrl: string;
  scope: string[];
  enabled: boolean;
}

interface MFAConfig {
  required: boolean;
  methods: MFAMethod[];
  backupCodes: {
    enabled: boolean;
    count: number;
  };
  trustedDevices: {
    enabled: boolean;
    expiry: number; // days
  };
}

type MFAMethod = 'totp' | 'sms' | 'email' | 'hardware';

interface SecurityConfig {
  passwordPolicy: PasswordPolicy;
  accountLockout: LockoutPolicy;
  rateLimiting: RateLimitConfig;
  auditLogging: boolean;
}

interface PasswordPolicy {
  minLength: number;
  requireUppercase: boolean;
  requireLowercase: boolean;
  requireNumbers: boolean;
  requireSymbols: boolean;
  prohibitCommon: boolean;
  historyCount: number; // prevent reuse
  maxAge: number; // days
}

interface LockoutPolicy {
  enabled: boolean;
  maxAttempts: number;
  lockoutDuration: number; // minutes
  progressiveLockout: boolean;
}

interface User {
  id: string;
  email: string;
  username?: string;
  profile: UserProfile;
  status: UserStatus;
  roles: Role[];
  permissions: Permission[];
  mfaEnabled: boolean;
  lastLogin: Date;
  createdAt: Date;
  updatedAt: Date;
}

interface UserProfile {
  firstName?: string;
  lastName?: string;
  displayName?: string;
  avatar?: string;
  timezone?: string;
  locale?: string;
  preferences: Record<string, any>;
}

type UserStatus = 'active' | 'inactive' | 'suspended' | 'pending_verification';

interface Role {
  id: string;
  name: string;
  description: string;
  permissions: Permission[];
  isSystemRole: boolean;
}

interface Permission {
  id: string;
  resource: string;
  action: string;
  conditions?: PolicyCondition[];
}

interface PolicyCondition {
  attribute: string;
  operator: 'equals' | 'contains' | 'in' | 'greater_than' | 'less_than';
  value: any;
}

interface AuthenticationRequest {
  email?: string;
  username?: string;
  password: string;
  mfaCode?: string;
  rememberMe?: boolean;
  deviceId?: string;
}

interface AuthenticationResponse {
  success: boolean;
  accessToken?: string;
  refreshToken?: string;
  user?: User;
  mfaRequired?: boolean;
  error?: {
    code: string;
    message: string;
    details?: any;
  };
}

interface AuthorizationRequest {
  userId: string;
  resource: string;
  action: string;
  context?: Record<string, any>;
}

interface AuthorizationResponse {
  allowed: boolean;
  reason?: string;
  conditions?: PolicyCondition[];
}

// Main service interface
interface UserAuthorizationService {
  // Authentication
  authenticate(request: AuthenticationRequest): Promise<AuthenticationResponse>;
  refreshToken(refreshToken: string): Promise<AuthenticationResponse>;
  logout(userId: string, sessionId?: string): Promise<void>;
  logoutAll(userId: string): Promise<void>;
  
  // Authorization
  authorize(request: AuthorizationRequest): Promise<AuthorizationResponse>;
  checkPermission(userId: string, permission: string): Promise<boolean>;
  getUserPermissions(userId: string): Promise<Permission[]>;
  
  // User Management
  registerUser(userData: Partial<User>, password: string): Promise<User>;
  updateUser(userId: string, updates: Partial<User>): Promise<User>;
  deleteUser(userId: string): Promise<void>;
  getUserById(userId: string): Promise<User>;
  getUserByEmail(email: string): Promise<User>;
  
  // Password Management
  changePassword(userId: string, currentPassword: string, newPassword: string): Promise<void>;
  resetPassword(email: string): Promise<void>;
  confirmPasswordReset(token: string, newPassword: string): Promise<void>;
  
  // MFA Management
  enableMFA(userId: string, method: MFAMethod): Promise<MFASetupResponse>;
  disableMFA(userId: string, method: MFAMethod): Promise<void>;
  verifyMFA(userId: string, code: string): Promise<boolean>;
  generateBackupCodes(userId: string): Promise<string[]>;
  
  // Role and Permission Management
  assignRole(userId: string, roleId: string): Promise<void>;
  revokeRole(userId: string, roleId: string): Promise<void>;
  createRole(role: Omit<Role, 'id'>): Promise<Role>;
  updateRole(roleId: string, updates: Partial<Role>): Promise<Role>;
  deleteRole(roleId: string): Promise<void>;
  
  // OAuth Integration
  initiateOAuth(provider: string, state?: string): Promise<OAuthInitResponse>;
  handleOAuthCallback(provider: string, code: string, state: string): Promise<AuthenticationResponse>;
  linkOAuthAccount(userId: string, provider: string, oauthUserId: string): Promise<void>;
  unlinkOAuthAccount(userId: string, provider: string): Promise<void>;
  
  // Privacy and Compliance
  exportUserData(userId: string): Promise<UserDataExport>;
  deleteUserData(userId: string): Promise<void>;
  getDataProcessingConsent(userId: string): Promise<ConsentRecord[]>;
  updateDataProcessingConsent(userId: string, consent: ConsentUpdate): Promise<void>;
  
  // Administration
  getAuditLog(filters: AuditLogFilters): Promise<AuditLogEntry[]>;
  getSecurityMetrics(timeRange: TimeRange): Promise<SecurityMetrics>;
  getActiveUsers(timeRange: TimeRange): Promise<UserActivity[]>;
}

class JWTTokenService {
  private publicKey: string;
  private privateKey: string;

  constructor(private config: JWTConfig) {
    this.loadKeys();
  }

  public async generateTokens(user: User, sessionId: string): Promise<TokenPair> {
    const now = Math.floor(Date.now() / 1000);
    
    const accessTokenPayload = {
      sub: user.id,
      email: user.email,
      roles: user.roles.map(r => r.name),
      permissions: this.flattenPermissions(user.permissions),
      session: sessionId,
      iat: now,
      exp: now + this.config.accessTokenExpiry,
      iss: this.config.issuer,
      aud: this.config.audience
    };

    const refreshTokenPayload = {
      sub: user.id,
      session: sessionId,
      type: 'refresh',
      iat: now,
      exp: now + this.config.refreshTokenExpiry,
      iss: this.config.issuer,
      aud: this.config.audience
    };

    const accessToken = await this.signToken(accessTokenPayload);
    const refreshToken = await this.signToken(refreshTokenPayload);

    return { accessToken, refreshToken };
  }

  public async validateToken(token: string): Promise<TokenValidationResult> {
    try {
      const payload = await this.verifyToken(token);
      
      // Check if token is blacklisted
      const isBlacklisted = await this.isTokenBlacklisted(token);
      if (isBlacklisted) {
        return { valid: false, reason: 'Token blacklisted' };
      }

      // Check session validity
      const sessionValid = await this.validateSession(payload.session, payload.sub);
      if (!sessionValid) {
        return { valid: false, reason: 'Session invalid' };
      }

      return { valid: true, payload };
    } catch (error) {
      return { valid: false, reason: error.message };
    }
  }

  public async refreshTokens(refreshToken: string): Promise<TokenPair> {
    const validation = await this.validateToken(refreshToken);
    if (!validation.valid || validation.payload.type !== 'refresh') {
      throw new Error('Invalid refresh token');
    }

    const user = await this.getUserById(validation.payload.sub);
    if (!user || user.status !== 'active') {
      throw new Error('User not found or inactive');
    }

    // Generate new token pair
    const newTokens = await this.generateTokens(user, validation.payload.session);
    
    // Blacklist old refresh token
    await this.blacklistToken(refreshToken);
    
    return newTokens;
  }

  public async blacklistToken(token: string): Promise<void> {
    const payload = this.decodeToken(token);
    if (payload && payload.exp) {
      const ttl = payload.exp - Math.floor(Date.now() / 1000);
      if (ttl > 0) {
        await this.addToBlacklist(token, ttl);
      }
    }
  }

  private async signToken(payload: any): Promise<string> {
    return jwt.sign(payload, this.privateKey, {
      algorithm: this.config.algorithm as jwt.Algorithm
    });
  }

  private async verifyToken(token: string): Promise<any> {
    return jwt.verify(token, this.publicKey, {
      issuer: this.config.issuer,
      audience: this.config.audience,
      algorithms: [this.config.algorithm as jwt.Algorithm]
    });
  }

  private flattenPermissions(permissions: Permission[]): string[] {
    return permissions.map(p => `${p.resource}:${p.action}`);
  }

  private async loadKeys(): Promise<void> {
    if (this.config.algorithm.startsWith('RS') || this.config.algorithm.startsWith('ES')) {
      // Load RSA/ECDSA keys from secure storage
      this.privateKey = await this.loadPrivateKey();
      this.publicKey = await this.loadPublicKey();
    } else {
      // Use shared secret for HMAC
      this.privateKey = this.publicKey = this.config.secretKey;
    }
  }
}

interface TokenPair {
  accessToken: string;
  refreshToken: string;
}

interface TokenValidationResult {
  valid: boolean;
  payload?: any;
  reason?: string;
}

class MFAManager {
  constructor(
    private config: MFAConfig,
    private userRepository: UserRepository,
    private smsService: SMSService,
    private emailService: EmailService
  ) {}

  public async setupTOTP(userId: string): Promise<TOTPSetupResponse> {
    const user = await this.userRepository.findById(userId);
    if (!user) {
      throw new Error('User not found');
    }

    // Generate secret
    const secret = speakeasy.generateSecret({
      name: `Augment-It (${user.email})`,
      issuer: 'Augment-It Platform',
      length: 32
    });

    // Store secret (encrypted) temporarily
    await this.storeTempMFASecret(userId, 'totp', secret.base32);

    return {
      secret: secret.base32,
      qrCodeUrl: secret.otpauth_url,
      backupCodes: await this.generateBackupCodes(userId)
    };
  }

  public async verifyTOTP(userId: string, token: string, confirm: boolean = false): Promise<boolean> {
    const secret = await this.getMFASecret(userId, 'totp', !confirm);
    if (!secret) {
      throw new Error('TOTP not configured');
    }

    const verified = speakeasy.totp.verify({
      secret: secret,
      encoding: 'base32',
      token: token,
      window: 2 // Allow 2 time periods of drift
    });

    if (verified && confirm) {
      // Confirm setup and enable TOTP
      await this.confirmMFASetup(userId, 'totp', secret);
      await this.removeTempMFASecret(userId, 'totp');
    }

    return verified;
  }

  public async sendSMSCode(userId: string, phoneNumber: string): Promise<void> {
    // Generate 6-digit code
    const code = Math.floor(100000 + Math.random() * 900000).toString();
    
    // Store code with expiry
    await this.storeMFACode(userId, 'sms', code, 300); // 5 minutes
    
    // Send SMS
    await this.smsService.sendMessage(phoneNumber, 
      `Your Augment-It verification code is: ${code}. Valid for 5 minutes.`
    );
  }

  public async sendEmailCode(userId: string, email: string): Promise<void> {
    // Generate 6-digit code
    const code = Math.floor(100000 + Math.random() * 900000).toString();
    
    // Store code with expiry
    await this.storeMFACode(userId, 'email', code, 300); // 5 minutes
    
    // Send email
    await this.emailService.sendTemplate(email, 'mfa-verification', {
      code: code,
      expiryMinutes: 5
    });
  }

  public async verifyCode(userId: string, method: MFAMethod, code: string): Promise<boolean> {
    if (method === 'totp') {
      return this.verifyTOTP(userId, code);
    }

    // Verify SMS/Email code
    const storedCode = await this.getMFACode(userId, method);
    if (!storedCode) {
      return false;
    }

    const verified = storedCode === code;
    if (verified) {
      await this.removeMFACode(userId, method);
    }

    return verified;
  }

  public async generateBackupCodes(userId: string): Promise<string[]> {
    const codes = [];
    for (let i = 0; i < this.config.backupCodes.count; i++) {
      codes.push(this.generateRandomCode(8));
    }

    // Store hashed backup codes
    const hashedCodes = await Promise.all(
      codes.map(code => bcrypt.hash(code, 12))
    );

    await this.storeBackupCodes(userId, hashedCodes);
    
    return codes; // Return unhashed codes to user
  }

  public async verifyBackupCode(userId: string, code: string): Promise<boolean> {
    const backupCodes = await this.getBackupCodes(userId);
    
    for (const hashedCode of backupCodes) {
      if (await bcrypt.compare(code, hashedCode)) {
        // Remove used backup code
        await this.removeBackupCode(userId, hashedCode);
        return true;
      }
    }
    
    return false;
  }

  private generateRandomCode(length: number): string {
    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
    let result = '';
    for (let i = 0; i < length; i++) {
      result += chars.charAt(Math.floor(Math.random() * chars.length));
    }
    return result;
  }

  private async storeMFACode(userId: string, method: MFAMethod, code: string, ttlSeconds: number): Promise<void> {
    const key = `mfa:${method}:${userId}`;
    await this.redis.setex(key, ttlSeconds, code);
  }

  private async getMFACode(userId: string, method: MFAMethod): Promise<string | null> {
    const key = `mfa:${method}:${userId}`;
    return await this.redis.get(key);
  }

  private async removeMFACode(userId: string, method: MFAMethod): Promise<void> {
    const key = `mfa:${method}:${userId}`;
    await this.redis.del(key);
  }
}

interface TOTPSetupResponse {
  secret: string;
  qrCodeUrl: string;
  backupCodes: string[];
}

interface MFASetupResponse {
  method: MFAMethod;
  setupData?: TOTPSetupResponse;
  backupCodes?: string[];
}

class OAuthManager {
  constructor(
    private config: OAuthConfig,
    private userRepository: UserRepository
  ) {}

  public async initiateOAuth(provider: string, state?: string): Promise<OAuthInitResponse> {
    const providerConfig = this.config.providers.find(p => p.name === provider);
    if (!providerConfig || !providerConfig.enabled) {
      throw new Error(`OAuth provider ${provider} not supported or disabled`);
    }

    const stateValue = state || this.generateState();
    await this.storeOAuthState(stateValue, provider);

    const authUrl = new URL(providerConfig.authorizationUrl);
    authUrl.searchParams.append('client_id', providerConfig.clientId);
    authUrl.searchParams.append('redirect_uri', this.config.redirectUri);
    authUrl.searchParams.append('scope', providerConfig.scope.join(' '));
    authUrl.searchParams.append('state', stateValue);
    authUrl.searchParams.append('response_type', 'code');

    return {
      authorizationUrl: authUrl.toString(),
      state: stateValue
    };
  }

  public async handleCallback(provider: string, code: string, state: string): Promise<AuthenticationResponse> {
    // Validate state
    const storedProvider = await this.validateOAuthState(state);
    if (storedProvider !== provider) {
      throw new Error('Invalid OAuth state');
    }

    const providerConfig = this.config.providers.find(p => p.name === provider);
    if (!providerConfig) {
      throw new Error(`OAuth provider ${provider} not found`);
    }

    // Exchange code for access token
    const tokenResponse = await this.exchangeCodeForToken(providerConfig, code);
    
    // Get user info from OAuth provider
    const userInfo = await this.getUserInfo(providerConfig, tokenResponse.access_token);
    
    // Find or create user
    let user = await this.userRepository.findByEmail(userInfo.email);
    if (!user) {
      user = await this.createUserFromOAuth(userInfo, provider);
    } else {
      // Link OAuth account if not already linked
      await this.linkOAuthAccount(user.id, provider, userInfo.id);
    }

    // Generate JWT tokens
    const sessionId = this.generateSessionId();
    const tokens = await this.jwtService.generateTokens(user, sessionId);
    
    return {
      success: true,
      accessToken: tokens.accessToken,
      refreshToken: tokens.refreshToken,
      user: user
    };
  }

  private async exchangeCodeForToken(provider: OAuthProvider, code: string): Promise<OAuthTokenResponse> {
    const response = await fetch(provider.tokenUrl, {
      method: 'POST',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Accept': 'application/json'
      },
      body: new URLSearchParams({
        grant_type: 'authorization_code',
        client_id: provider.clientId,
        client_secret: provider.clientSecret,
        code: code,
        redirect_uri: this.config.redirectUri
      })
    });

    if (!response.ok) {
      throw new Error(`OAuth token exchange failed: ${response.statusText}`);
    }

    return await response.json();
  }

  private async getUserInfo(provider: OAuthProvider, accessToken: string): Promise<OAuthUserInfo> {
    const response = await fetch(provider.userInfoUrl, {
      headers: {
        'Authorization': `Bearer ${accessToken}`,
        'Accept': 'application/json'
      }
    });

    if (!response.ok) {
      throw new Error(`Failed to fetch user info: ${response.statusText}`);
    }

    return await response.json();
  }

  private generateState(): string {
    return crypto.randomBytes(32).toString('hex');
  }

  private async storeOAuthState(state: string, provider: string): Promise<void> {
    await this.redis.setex(`oauth:state:${state}`, this.config.stateExpiry, provider);
  }

  private async validateOAuthState(state: string): Promise<string | null> {
    const provider = await this.redis.get(`oauth:state:${state}`);
    if (provider) {
      await this.redis.del(`oauth:state:${state}`);
    }
    return provider;
  }
}

interface OAuthInitResponse {
  authorizationUrl: string;
  state: string;
}

interface OAuthTokenResponse {
  access_token: string;
  token_type: string;
  expires_in: number;
  refresh_token?: string;
  scope?: string;
}

interface OAuthUserInfo {
  id: string;
  email: string;
  name?: string;
  given_name?: string;
  family_name?: string;
  picture?: string;
}