//! Authentication DTOs — login, register, and token refresh payloads.

use serde::{Deserialize, Serialize};

/// Request body for `POST /auth/login`.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LoginRequest {
    /// Username or email identifier.
    pub username: String,
    /// Plaintext password.
    pub password: String,
}

/// Request body for `POST /auth/register`.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RegisterRequest {
    /// Desired username.
    pub username: String,
    /// Plaintext password (will be hashed server-side).
    pub password: String,
    /// Optional display name.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub display_name: Option<String>,
}

/// Request body for `POST /auth/refresh`.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RefreshRequest {
    /// The refresh token issued during login.
    pub refresh_token: String,
}

/// Response body for auth endpoints (login, register, refresh).
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct AuthResponse {
    /// JWT access token (short-lived, typically 1 hour).
    pub access_token: String,
    /// JWT refresh token (long-lived, typically 7 days).
    pub refresh_token: String,
    /// Token type (always `"Bearer"`).
    pub token_type: String,
    /// Expiry of the access token in seconds.
    pub expires_in: u64,
}

/// Claims exposed in the JWT payload, returned from introspection.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ClaimsResponse {
    /// Subject identifier (username).
    pub sub: String,
    /// Issued-at timestamp (epoch seconds).
    pub iat: u64,
    /// Expiry timestamp (epoch seconds).
    pub exp: u64,
}