import { AdminRole } from './permission.model';
/** Wire contracts for the Ed25519 challenge/response admin auth flow. */
export interface AuthChallenge {
    nonce: string;
    /** ISO 8601 issue time of the challenge. */
    issuedAt: string;
    /** ISO 8601 - challenge must be used before this or the backend rejects it. */
    expiresAt: string;
}
export interface VerifySignatureRequest {
    publicKey: string;
    signature: string;
    nonce: string;
}
export interface AuthTokenPair {
    token: string;
    refreshToken: string;
}
export interface RefreshTokenRequest {
    refreshToken: string;
}
/**
 * Claims expected in the JWT `token`. Decoded client-side for display/UX
 * only (role-gating UI, expiry countdown) - the frontend never treats this
 * as proof of authorization; every admin request is still re-checked
 * server-side.
 */
export interface JwtClaims {
    sub: string;
    role: AdminRole;
    /** Issued-at, seconds since epoch (standard `iat` claim). */
    iat: number;
    /** Expiry, seconds since epoch (standard `exp` claim). */
    exp: number;
    publicKey: string;
}