/** How a client proves who it is to get tokens from the identity server. */
export type TokenGrant =
  | {
      type: 'authorization_code';
      code: string;
      codeVerifier: string;
      redirectUri: string;
    }
  | { type: 'password'; username: string; password: string }
  | { type: 'refresh_token'; refreshToken: string };

export interface TokenSet {
  accessToken: string;
  refreshToken: string | null;
  /** Seconds until the access token expires. */
  expiresIn: number;
  tokenType: string;
}

/** How a browser can sign in. */
export interface AuthorizationConfig {
  authorizeUrl: string;
  /**
   * Client for Authorization Code + PKCE ("Sign in with Pireon"). Null when
   * only email + password is configured: Pireon clients allow a single grant.
   */
  clientId: string | null;
  scopes: string[];
  /** Whether email + password sign-in is available. */
  passwordGrant: boolean;
}