export interface SSOUserData {
  oktaSub: string; // Required - Okta subject identifier
  email: string; // Required - Primary identifier for user lookup
  employeeId?: string; // Optional - HR System Employee ID
  firstName?: string;
  lastName?: string;
  displayName?: string;
  department?: string;
  designation?: string;
  phone?: string;
  reportingManagerId?: string;
}

export interface SSOConfig {
  jwtSecret: string;
  jwtExpiry: string;
  refreshTokenExpiry: string;
  sessionSecret: string;
  allowedOrigins: string[];
  oktaDomain: string;
  oktaClientId: string;
  oktaClientSecret: string;
}

export interface AuthTokens {
  accessToken: string;
  refreshToken: string;
}

export interface LoginResponse {
  user: {
    userId: string;
    employeeId?: string | null;
    email: string;
    firstName?: string | null;
    lastName?: string | null;
    displayName?: string | null;
    department?: string | null;
    designation?: string | null;
    role: 'USER' | 'MANAGEMENT' | 'ADMIN';
  };
  accessToken: string;
  refreshToken: string;
  oktaRefreshToken?: string;
  oktaAccessToken?: string;
  oktaIdToken?: string; // ID token for Okta logout
}
