import { AdminRole } from './permission.model';

/**
 * Wire contracts for the Ed25519 challenge/response admin auth flow. These
 * are documented in docs/AUTH.md and match the endpoints listed there
 * exactly - none of this is invented beyond what's documented as FUTURE
 * there and in docs/backend/BACKEND-INTEGRATION.md §2.5.
 */
export interface AuthChallenge {
  nonce: string;
  /** ISO 8601 issue time of the challenge. */
  issuedAt: string;
  /** ISO 8601 - challenge must be used before this or the backend rejects it. */
  expiresAt: string;
}

export interface VerifySignatureRequest {
  publicKey: string;
  signature: string;
  nonce: string;
}

export interface AuthTokenPair {
  token: string;
  refreshToken: string;
}

export interface RefreshTokenRequest {
  refreshToken: string;
}

/**
 * Claims expected in the JWT `token`. Decoded client-side for display/UX
 * only (role-gating UI, expiry countdown) - the frontend never treats this
 * as proof of authorization; every admin request is still re-checked
 * server-side per docs/AUTH.md security considerations.
 */
export interface JwtClaims {
  sub: string;
  role: AdminRole;
  /** Issued-at, seconds since epoch (standard `iat` claim). */
  iat: number;
  /** Expiry, seconds since epoch (standard `exp` claim). */
  exp: number;
  publicKey: string;
}
