namespace ErsatzTV.Application.Auth;

/// <summary>
///     Shared constants for the browser-SPA session authentication (issue #295): the cookie scheme name,
///     the custom claim types the local-login path stamps onto the principal, and the auth-method marker
///     values. The web host (cookie <c>OnValidatePrincipal</c>, <c>AuthController</c>) and the Application
///     handlers both reference these so the claim contract has a single definition.
/// </summary>
public static class AuthConstants
{
    /// <summary>The cookie authentication scheme name shared by local login and the OIDC callback.</summary>
    public const string CookieScheme = "cookie";

    /// <summary>The OIDC challenge scheme name.</summary>
    public const string OidcScheme = "oidc";

    /// <summary>Claim type recording how the principal signed in (<see cref="MethodLocal" /> / <see cref="MethodOidc" />).</summary>
    public const string AuthMethodClaim = "etv:auth_method";

    /// <summary>Claim type carrying the local admin's security stamp (checked on every request to revoke sessions).</summary>
    public const string SecurityStampClaim = "etv:security_stamp";

    public const string MethodLocal = "local";
    public const string MethodOidc = "oidc";

    /// <summary>Minimum length for a local admin password.</summary>
    public const int MinPasswordLength = 8;
}