// Auth DTOs (docs/11-BACKEND-PHASE1.md §2.0 — ERPCore's proxy over the AuthHex IdP).
//
// Session-issuing responses carry NO tokens: the access/refresh tokens are delivered only
// as httpOnly cookies (erp_at / erp_rt). The body is user + expiry, nothing else.

/** AuthHex user projection. Note `fullname` is one word here (it is `fullName` on update). */
export interface AuthUser {
  userId: string | null
  roleId: string | null
  userTypeId: string | null
  fullname: string | null
  userName: string | null
  nic: string | null
  email: string | null
  mobileNumber: string | null
  emailVerified: boolean | null
  mobileNumberVerified: boolean | null
  isActive: boolean | null
  isLocked: boolean | null
}

export interface AuthSession {
  user: AuthUser | null
  /** Seconds until the access cookie expires. */
  expiresIn: number
}

export interface LoginRequest {
  identifier: string
  password: string
  /** Optional AuthHex user-type filter; the login screen does not send one. */
  userTypeId?: string | null
  deviceName?: string | null
}

export interface RegisterRequest {
  roleId: string
  userTypeId: string
  fullname?: string | null
  userName?: string | null
  nic?: string | null
  email?: string | null
  mobileNumber?: string | null
  password?: string | null
  deviceName?: string | null
}
