// keycloak's events. Keycloak's worth to the mesh is in what it changes — an identity created, a
// client registered, a password reset — so its events are emitted from the admin actions themselves
// (novox/hq ADR 0041/0042), not scraped back by polling. This module is the single vocabulary for
// them: every keycloak event goes through one of the helpers here, and the tools call them at the
// point the change succeeds.
//
// Emits:
//   module.keycloak.user.created / .deleted    — an identity appeared or was removed
//   module.keycloak.password.reset             — a user's credential was reset (no secret in the body)
//   module.keycloak.client.created             — an OIDC client was registered
//   module.keycloak.group.created              — a group was created
//   module.keycloak.role.created               — a realm role was created
// Consumes:
//   nothing — Keycloak is upstream of the things that authenticate against it; it reacts to none of
//   their events. There is no honest `on(...)` to write, so there is none.

import { emit } from "@novox/mesh-sdk/events";

// A completed admin action must not be undone by a flaky broker: the change already happened in
// Keycloak, so a failed emit is logged and swallowed rather than thrown back through the tool.
async function announce(type: string, body: Record<string, unknown>): Promise<void> {
  try {
    await emit(type, body);
  } catch (err) {
    console.error(`[keycloak] emit ${type} failed: ${err}`);
  }
}

export const events = {
  userCreated: (realm: string, username: string, email?: string) =>
    announce("user.created", { realm, username, ...(email ? { email } : {}) }),
  userDeleted: (realm: string, userId: string) =>
    announce("user.deleted", { realm, userId }),
  passwordReset: (realm: string, userId: string) =>
    announce("password.reset", { realm, userId }),
  clientCreated: (realm: string, clientId: string, name?: string) =>
    announce("client.created", { realm, clientId, ...(name ? { name } : {}) }),
  groupCreated: (realm: string, name: string) =>
    announce("group.created", { realm, name }),
  roleCreated: (realm: string, name: string) =>
    announce("role.created", { realm, name }),
};

console.log("[keycloak] event surface ready — identity, client, group and role changes are announced");