export type OAuthClient = {
  id: string
  name: string
  redirectUris: string[]
  scopes: string[]
  confidential: boolean
  createdAt: Date
}

export type RegisterOAuthClientResult = {
  clientId: string
  clientSecret?: string
}

export type RegisterOAuthClientInput = {
  id?: string
  name: string
  redirectUris: string[]
  scopes: string[]
  confidential: boolean
}

export type AuthorizeInput = {
  clientId: string
  redirectUri: string
  codeChallenge: string
  codeChallengeMethod: 'S256'
  scope: string
}

export type OAuthAuthorizationPrincipal = {
  subjectId: string
  tenantId: string
}

export type ExchangeTokenInput = {
  code: string
  codeVerifier: string
  clientId: string
  /** Must equal the `redirectUri` the code was issued against (RFC 6749 §4.1.3). */
  redirectUri: string
  clientSecret?: string
}

export type OAuthTokenResult = {
  accessToken: string
  tokenType: 'Bearer'
  expiresIn: number
  scope: string
}

/** `token` is the only OAuth wire payload; `authorizationPrincipal` is host-internal. */
export type OAuthTokenExchangeResult = {
  token: OAuthTokenResult
  authorizationPrincipal: OAuthAuthorizationPrincipal
}