auth

type AuthProvider interface {
	// StartDeviceCodeFlow initiates the OAuth 2.0 Device Code flow.
	StartDeviceCodeFlow(ctx context.Context) (*DeviceCodeResponse, error)

	// PollDeviceCode checks if the user has completed browser authorization.
	// Returns ErrAuthorizationPending if the user hasn't authorized yet.
	PollDeviceCode(ctx context.Context, deviceCode string) (*TokenPair, error)

	// GetAccessToken returns a valid access token, refreshing if necessary.
	GetAccessToken(ctx context.Context) (string, error)

	// GetIdentity returns the current authenticated user's identity.
	GetIdentity(ctx context.Context) (*Identity, error)

	// Logout clears stored tokens.
	Logout(ctx context.Context) error

	// IsLoggedIn returns true if the user has a valid (or refreshable) token.
	IsLoggedIn() bool
}

type DeviceCodeResponse struct {
	DeviceCode      string `json:"deviceCode"`
	UserCode        string `json:"userCode"`
	VerificationURL string `json:"verificationUrl"`
	ExpiresIn       int    `json:"expiresIn"`
	PollInterval    int    `json:"pollInterval"`
}

type Identity struct {
	UserID    string    `json:"userId"`
	OrgID     string    `json:"orgId"`
	Email     string    `json:"email"`
	Roles     []string  `json:"roles"`
	Plan      string    `json:"plan"`
	ExpiresAt time.Time `json:"expiresAt"`
}

type TokenPair struct {
	AccessToken  string    `json:"accessToken"`
	RefreshToken string    `json:"refreshToken"`
	ExpiresAt    time.Time `json:"expiresAt"`
	UserID       string    `json:"userId"`
}