37 lines
1.1 KiB
TypeScript
37 lines
1.1 KiB
TypeScript
import { AdminRole } from './permission.model';
|
|
/** Wire contracts for the Ed25519 challenge/response admin auth flow. */
|
|
export interface AuthChallenge {
|
|
nonce: string;
|
|
/** ISO 8601 issue time of the challenge. */
|
|
issuedAt: string;
|
|
/** ISO 8601 - challenge must be used before this or the backend rejects it. */
|
|
expiresAt: string;
|
|
}
|
|
export interface VerifySignatureRequest {
|
|
publicKey: string;
|
|
signature: string;
|
|
nonce: string;
|
|
}
|
|
export interface AuthTokenPair {
|
|
token: string;
|
|
refreshToken: string;
|
|
}
|
|
export interface RefreshTokenRequest {
|
|
refreshToken: string;
|
|
}
|
|
/**
|
|
* Claims expected in the JWT `token`. Decoded client-side for display/UX
|
|
* only (role-gating UI, expiry countdown) - the frontend never treats this
|
|
* as proof of authorization; every admin request is still re-checked
|
|
* server-side.
|
|
*/
|
|
export interface JwtClaims {
|
|
sub: string;
|
|
role: AdminRole;
|
|
/** Issued-at, seconds since epoch (standard `iat` claim). */
|
|
iat: number;
|
|
/** Expiry, seconds since epoch (standard `exp` claim). */
|
|
exp: number;
|
|
publicKey: string;
|
|
}
|