/**
 * JWT payload shape expected from platform-service tokens.
 * Re-exported from @bytelyst/auth for convenience.
 */
export interface AuthPayload {
  sub: string;
  email?: string;
  role?: string;
  productId?: string;
  type?: string;
  iat?: number;
  exp?: number;
  iss?: string;
}

/** JWT payload shape attached to req by the onRequest hook. */
export interface JwtPayload {
  sub: string;
  email?: string;
  role?: string;
  productId?: string;
  type?: string;
}

/** Options for creating the auth middleware. */
export interface FastifyAuthOptions {
  /** HS256 symmetric secret for JWT verification. May be a getter for dynamic config. */
  jwtSecret: string | (() => string);
  /** Optional RS256 JWKS endpoint URL (tried first, falls back to HS256). May be a getter. */
  jwksUrl?: string | (() => string | undefined);
}

/** Options for creating the request context helpers. */
export interface RequestContextOptions {
  /** The product ID this backend serves (e.g. 'peakpulse', 'nomgap'). */
  productId: string;
}

// Augment Fastify request to include parsed JWT payload
declare module 'fastify' {
  interface FastifyRequest {
    jwtPayload?: JwtPayload;
  }
}
