export interface TokenPayload {
  sub: string;
  email?: string;
  role?: string;
  productId?: string;
  type?: 'access' | 'refresh';
  [key: string]: unknown;
}

export interface AuthPayload {
  sub: string;
  email?: string;
  role?: string;
  productId?: string;
  type?: string;
}

export interface JwtUtilsOptions {
  issuer: string;
  accessTokenExpiry?: string;
  refreshTokenExpiry?: string;
  /** JWT signing algorithm. Default: 'HS256'. Set to 'RS256' for asymmetric. */
  algorithm?: 'HS256' | 'RS256';
  /** RSA private key (PEM) for RS256 signing. Required when algorithm is 'RS256'. */
  rsaPrivateKey?: string;
  /** RSA public key (PEM) for RS256 verification. Used when algorithm is 'RS256'. */
  rsaPublicKey?: string;
  /** Remote JWKS URL for RS256 verification (e.g. platform-service /.well-known/jwks.json). */
  jwksUrl?: string;
}

export interface JwtUtils {
  createAccessToken(payload: {
    sub: string;
    email: string;
    role: string;
    productId?: string;
  }): Promise<string>;
  createRefreshToken(payload: { sub: string; productId?: string }): Promise<string>;
  verifyToken(token: string): Promise<TokenPayload | null>;
}
