auth

type TokenProvider interface {
	// GetToken returns a valid ID token for portal Bearer auth.
	GetToken(ctx context.Context) (string, error)
	// Login performs the interactive OIDC login flow.
	Login(ctx context.Context) error
	// Logout clears stored credentials.
	Logout() error
	// UserInfo returns cached user claims from the stored ID token.
	UserInfo() (*UserInfo, error)
}

type UserInfo struct {
	Email     string    `json:"email"`
	Name      string    `json:"name"`
	Sub       string    `json:"sub"`
	Groups    []string  `json:"groups"`
	ExpiresAt time.Time `json:"-"` // set from token expiry, not from JWT claims
}