/*
 * SPDX-License-Identifier: GPL-3.0-or-later
 */
package com.runicgateway.app.data.api.dto

import kotlinx.serialization.SerialName
import kotlinx.serialization.Serializable

/**
 * Wire shapes for the Mobile SSO Authorization Bridge (PLAN.md §4.2, M9). The
 * success payload of `/auth/mobile/sso/exchange` is the shared [MobileTokenResponse]
 * (same pair as `/auth/mobile/login`) — this file only adds the two shapes unique
 * to the bridge. Every DTO ignores unknown keys (NetworkModule's lenient Json), so
 * additive backend fields stay safe (§8).
 */

/**
 * One entry of `GET /auth/providers` — public discovery, never secrets. [icon] is
 * the provider kind (`google` | `discord` | `oidc` | `oauth2`); the app renders a
 * button per provider from this list rather than hardcoding a set. [loginUrl] is
 * the *website* start path (unused by the app, which builds its own
 * `/auth/mobile/sso/start` URL); kept so the shape matches the backend exactly.
 */
@Serializable
data class SsoProviderDto(
    val id: String,
    val name: String,
    val icon: String? = null,
    val loginUrl: String? = null,
    val priority: Int? = null,
)

/**
 * `POST /auth/mobile/sso/exchange` body — the one-time authorization code from the
 * callback deep link plus the PKCE verifier stashed at `/start` (Layer B). Wire
 * name is snake_case to match the backend's `{ code, code_verifier }`.
 */
@Serializable
data class MobileSsoExchangeRequest(
    val code: String,
    @SerialName("code_verifier") val codeVerifier: String,
)
